SLN_Clean[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
SLN_Clean.exe
Size 104KB
Sample241108-zarxrsykey
SHA256 4b492680857354ccc2cd4c13ccfe9b661797f919d73c61c47673d7486d69a1b9
MD5 bf3e9b7e46595b1f772451a3246285a6
SHA1 ae3b5bd8a4e8d297502f7c7693c0d3234b509d97
SHA512 eb8575297b3ae72b2b3c107243f86d7a45499db582b308da13d11d64e08f7fe6983b92eeaa2ebf44438aa01118128358b15acc00ec0d64aefe5b5793abd27d9c
SSDEEP 1536:iZtoXa2tTkYLO7bJy8A2sA+2m9TGzNUs+8gf6mKBm1+1:imnVLsiGxRgf6mKBm
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SLN_Clean.exe

File Explorer

SLN_Clean.exe

.exe 104KB

SLN_Clean.exe

IMPHASH 3679d68e7a49670c9f2f2368f9b67eed
SHA256 4b492680857354ccc2cd4c13ccfe9b661797f919d73c61c47673d7486d69a1b9
MD5 bf3e9b7e46595b1f772451a3246285a6
SHA1 ae3b5bd8a4e8d297502f7c7693c0d3234b509d97
SHA512 eb8575297b3ae72b2b3c107243f86d7a45499db582b308da13d11d64e08f7fe6983b92eeaa2ebf44438aa01118128358b15acc00ec0d64aefe5b5793abd27d9c
SSDEEP 1536:iZtoXa2tTkYLO7bJy8A2sA+2m9TGzNUs+8gf6mKBm1+1:imnVLsiGxRgf6mKBm
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

69776

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\jnerf\source\repos\SLN_Clean\x64\Release\SLN_Clean.pdb

msvcp140

?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?tolower@?$ctype@D@std@@QEBADD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ??Bid@locale@std@@QEAA_KXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ _Strcoll ?_Syserror_map@std@@YAPEBDH@Z ?id@?$collate@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Winerror_map@std@@YAHH@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?uncaught_exception@std@@YA_NXZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Strxfrm ??7ios_base@std@@QEBA_NXZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __current_exception _CxxThrowException __C_specific_handler memset strchr __std_terminate __std_exception_copy __std_exception_destroy memcmp memcpy memmove

api-ms-win-crt-stdio-l1-1-0

setvbuf fgetpos fwrite _fseeki64 fread ungetc fgetc _get_stream_buffer_pointers fclose fflush fputc _set_fmode __p__commode fsetpos

api-ms-win-crt-heap-l1-1-0

realloc free malloc _callnewh _set_new_mode

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-runtime-l1-1-0

__p___argv _register_thread_local_exe_atexit_callback _cexit _exit exit __p___argc _c_exit _initterm _get_initial_narrow_environment _initialize_narrow_environment _register_onexit_function _initialize_onexit_table _set_app_type _seh_filter_exe _crt_atexit abort _initterm_e _invalid_parameter_noinfo_noreturn terminate _configure_narrow_argv

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

kernel32

LocalFree AreFileApisANSI CloseHandle GetLastError GetModuleHandleW GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateFileW GetLocaleInfoEx FormatMessageA