salinewin[.]exe | Triage™

Target
salinewin.exe
Size 283KB
Sample260425-tel97afs3p
SHA256 7163fefbf2f865ef78a2d3d4480532fffb979300d6f0a77b6f3fc5c4b0d2cada
MD5 2b1e9226d7e1015552a21faca891ec41
SHA1 f87fcbe10fa9312048214d4473498ad4f9f331ce
SHA512 1852f6d05c9fca962178bc190bc8c90f0ca54ea99714480690f44417e49eee6c392579091ae8a6cd053ec47ad1980dbbbc0db3e0e00520ee1bdbadbf8dc9d69e
SSDEEP 3072:HZVUJ58IAelkapH3shY6iEwgaBZP5pHQpYR95WPNpNMl3:nUJ5PzB5ZPPHQpY35WPNpGl3
TLSH
T10F547C10B5C0C4F1F87545366836CA910E6DFD399E601EAF3298736F0E751E2463BE6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
salinewin.exe

File Explorer

salinewin.exe

.exe 283KB

salinewin.exe

IMPHASH c9b441367974f8bcdb3c75cfd640f1a7
SHA256 7163fefbf2f865ef78a2d3d4480532fffb979300d6f0a77b6f3fc5c4b0d2cada
MD5 2b1e9226d7e1015552a21faca891ec41
SHA1 f87fcbe10fa9312048214d4473498ad4f9f331ce
SHA512 1852f6d05c9fca962178bc190bc8c90f0ca54ea99714480690f44417e49eee6c392579091ae8a6cd053ec47ad1980dbbbc0db3e0e00520ee1bdbadbf8dc9d69e
SSDEEP 3072:HZVUJ58IAelkapH3shY6iEwgaBZP5pHQpYR95WPNpNMl3:nUJ5PzB5ZPPHQpY35WPNpGl3
TLSH
T10F547C10B5C0C4F1F87545366836CA910E6DFD399E601EAF3298736F0E751E2463BE6A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13314

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\ACER\source\repos\salinewin\Release\salinewin.pdb

kernel32

DecodePointer WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP HeapReAlloc HeapSize GetProcessHeap GetStringTypeW GetFileType ExitProcess GetProcAddress CreateThread LoadLibraryW CloseHandle TerminateThread Sleep CreateFileW WriteFile FlushFileBuffers SetStdHandle LCMapStringW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW GetCurrentProcess TerminateProcess RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte GetModuleHandleExW GetCommandLineA GetCommandLineW GetACP HeapFree HeapAlloc WaitForSingleObject GetExitCodeProcess CreateProcessA GetFileAttributesExW FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA CompareStringW RaiseException

user32

GetCursorPos ReleaseDC SetCursorPos InvalidateRect GetDesktopWindow SendMessageTimeoutW GetDC MessageBoxW EnumChildWindows GetSystemMetrics DrawIcon LoadIconW

gdi32

SelectObject CreateDIBSection CreateCompatibleDC PolyBezier DeleteDC CreatePen Ellipse DeleteObject CreateSolidBrush BitBlt

winmm

waveOutOpen waveOutClose waveOutUnprepareHeader waveOutWrite waveOutPrepareHeader

Resubmissions

Sharing

General