sla[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

sla.exe
Size

10.1MB
MD5

c30cfb125c97e2a861b018da9dd2a739
SHA1

b160e47c7f6fd024df188be5ea46ea2e52aec45c
SHA256

d050e8a18fa8a03831a2e9ca61fb364c31b953a9c09596c5ecbc1084b03087f6
SHA512

1911f473e28427ce7236afd59dc6d8b0242836100905cf9e1fc680d96fa4acbaaabcb0431db213c3017a49be31eb10ccb27df7df193c719af0747194f715495f
SSDEEP

196608:2vcEjiEy+dBy+zGOYRoZKmKmrYD2t1psCPh0odQ9GMBE:J+Xy+hYU22t1psJo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
sla.exe

Files

sla.exe
.exe windows:6 windows x64 arch:x64

b712ea101c01f6cece467317c74f9f9a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegCloseKey

bcrypt

BCryptCreateHash

crypt32

CertFreeCertificateChainEngine

iphlpapi

GetAdaptersAddresses

kernel32

RtlPcToFileHeader
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

ncrypt

NCryptOpenKey

ole32

CoInitializeEx

oleaut32

SafeArrayGetVartype

user32

LoadStringW

version

GetFileVersionInfoExW

ws2_32

WSAConnect

api-ms-win-crt-math-l1-1-0

fmod

api-ms-win-crt-heap-l1-1-0

_callnewh

api-ms-win-crt-string-l1-1-0

wcsncmp

api-ms-win-crt-runtime-l1-1-0

__p___wargv

api-ms-win-crt-stdio-l1-1-0

_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Exports

Exports

DotNetRuntimeDebugHeader

Sections

.text
Size: - Virtual size: 827KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.managed
Size: - Virtual size: 7.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 13.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 843KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 599KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.5rx
Size: - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.>;t
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ZQl
Size: 10.1MB - Virtual size: 10.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b712ea101c01f6cece467317c74f9f9a

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

bcrypt

crypt32

iphlpapi

kernel32

ncrypt

ole32

oleaut32

user32

version

ws2_32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: - Virtual size: 827KB

.managed Size: - Virtual size: 7.2MB

.rdata Size: - Virtual size: 13.6MB

.data Size: - Virtual size: 843KB

.pdata Size: - Virtual size: 599KB

.5rx Size: - Virtual size: 1.8MB

.>;t Size: 5KB - Virtual size: 5KB

.ZQl Size: 10.1MB - Virtual size: 10.1MB

.rsrc Size: 4KB - Virtual size: 4KB

.text
Size: - Virtual size: 827KB

.managed
Size: - Virtual size: 7.2MB

.rdata
Size: - Virtual size: 13.6MB

.data
Size: - Virtual size: 843KB

.pdata
Size: - Virtual size: 599KB

.5rx
Size: - Virtual size: 1.8MB

.>;t
Size: 5KB - Virtual size: 5KB

.ZQl
Size: 10.1MB - Virtual size: 10.1MB

.rsrc
Size: 4KB - Virtual size: 4KB