salinewin1.5.zip
- SHA256 6ae2e736bcd1c612314ea49facd22f08753c6047763e7b62ef7abef9aa9d7ba9
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
salinewin1.5.exe
Resource
win11-20260130-en
windows11-21h2-x64
5 signatures
900 seconds
General
- Target salinewin1.5.zip
- Size 202KB
- Sample260506-bccnvsc13p
- SHA256 6ae2e736bcd1c612314ea49facd22f08753c6047763e7b62ef7abef9aa9d7ba9
- MD5 065a26b3f9570081f54201dad1bdc0e2
- SHA1 e311decefee96fc9afc2e96ccdedbb7b6bf5a6ab
- SHA512 a5710b30641d22db9fc2174d1f4151c76d50274df064207f5817fb80f4d5fc3411621b54d5775da3973b607c228a7ad58b6a02b79a6fd56ac0ae7bb56aa0e706
- SSDEEP 6144:oxNMcpOY7qY2Hglyi6x5LSBDdmz0DpQL/5:oxNMcpNWY2HEyF4/rw
- TLSH T186142375488F32D2E0A633C622DD06240D79C95F7333DD35C6F8BA5A6CD50296E42E2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/salinewin1.5-safety.exe unpack001/salinewin1.5.exe
File Explorer
-
salinewin1.5.zip.zip 202KB
-
readme.txt760B
-
salinewin1.5-safety.exe.exe 245KB
-
salinewin1.5.exe.exe 279KB
readme.txt
- SHA256 bb30cd5675d75102d1a73d39d784a85814aefc46cf5657f76c1ba3d2f20e8f96
- MD5 26f906de5a9836fd2ebc87fe99761c2b
- SHA1 65b7efe2dae3067e11bbe8cda5ac89006ed4d3cb
- SHA512 65e834e8a53638bbc0d2a34b81247adb03e8d09ceabe9813bd23b33a049b3d4517155f14d3e4a3883e2633d20bd114f7e279e1422a16bec45ae41e62de03074f
- TLSH T1AA01B16F710992F597C800625B5A6196A3ACC0BF77663F27591560DD2342955812B980
- MD5 SHA1 SHA512 TLSH
salinewin1.5-safety.exe
- IMPHASH 106168d1bd6a4669e663eb5e822d6613
- SHA256 bafd3d712a32b884001dccd7f6f77fd9aa515b254352310e20f67026364c7884
- MD5 e69d64dfc3d809dc8dbdda9c367b0afc
- SHA1 dc61951ccd463291bb2e2758fc8afebaa8ffadcc
- SHA512 d5e644ab734168d5f42028a6196aba091a60b8536e0101e15254ecc154f564b495f4d66d948399cd4de42f19423cb500a8f8b90d59652fb31e68f1375e28def5
- SSDEEP 3072:3WiJUpGuEy1AXy4e5II5CoTbLYiBZP5pHQpYR95WPNp/H:GBpduiPRZPPHQpY35WPNpf
- TLSH T127347D21B5C1C4F1F97945356836C9910E6AFC36AF501EAF3298332F0E751E2453AEAE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
12842
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\PC\source\repos\salinewin-safety\Release\salinewin-safety.pdb
kernel32
GetConsoleCP
HeapReAlloc
GetConsoleMode
SetFilePointerEx
WriteConsoleW
DecodePointer
CreateFileW
CreateThread
CloseHandle
TerminateThread
FlushFileBuffers
Sleep
HeapSize
GetProcessHeap
GetStringTypeW
GetFileType
SetStdHandle
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetACP
HeapFree
HeapAlloc
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
CompareStringW
LCMapStringW
RaiseException
user32
GetSystemMetrics
GetCursorPos
ReleaseDC
SetCursorPos
InvalidateRect
LoadIconW
GetDC
DrawIcon
gdi32
CreateCompatibleBitmap
SelectObject
CreateDIBSection
CreateCompatibleDC
PolyBezier
DeleteDC
CreatePen
Ellipse
DeleteObject
CreateSolidBrush
BitBlt
winmm
waveOutPrepareHeader
waveOutOpen
waveOutClose
waveOutUnprepareHeader
waveOutWrite
msimg32
AlphaBlend
Name
.text
Size
53KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
172B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
159KB
Virtual Size
158KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=241, version=40116,
count=120, id=243, version=40116,
count=25, id=242, version=40116,
count=17, id=259, version=24237,
count=29, id=261, version=24237,
count=17, id=260, version=24237,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=111, id=1, productName=Unmarked objects,
count=1, id=265, version=24247,
count=1, id=255, version=24247,
count=1, id=151,
count=1, id=258, version=24247,
salinewin1.5.exe
- IMPHASH 3fc652bbb2869637a8ab45305e4dc626
- SHA256 fbdaec9e16cb120887975def752432ff798834d521cfc87b24923bf6d3acfe4a
- MD5 7c4230a18208485741aa283707ce3a96
- SHA1 30d637688d60697379405272d6665bd8965d175f
- SHA512 81eebfa2f3ccffd8fe4714b6685760727c6c397ba27ea50b298777b8321a899dd94b49b0456e32072392249924fa1949daf5296be49d2c7827db1d36d6d56808
- SSDEEP 3072:qJ+qjy1h6nzfIIv2mGYndBO5CRNArWcMZuxo9AF3CrBZP5pHQpYR95WPNpHjcH:cDrIwBIrnCZPPHQpY35WPNpw
- TLSH T1F4547C11B5C1C4F1F97506366825CA910F6AFC359F905EAF3298332F0E751E2853AEAE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
13527
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\PC\source\repos\salinewin\Release\salinewin.pdb
kernel32
HeapReAlloc
HeapSize
FlushFileBuffers
GetStringTypeW
GetFileType
SetStdHandle
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
DecodePointer
ExitProcess
GetProcAddress
CreateThread
CloseHandle
LoadLibraryW
TerminateThread
Sleep
CreateFileW
WriteFile
GetProcessHeap
GetCurrentProcess
LCMapStringW
CompareStringW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
TerminateProcess
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetACP
HeapFree
HeapAlloc
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
RaiseException
user32
GetSystemMetrics
GetCursorPos
ReleaseDC
SetCursorPos
InvalidateRect
SendMessageTimeoutW
GetDC
GetDesktopWindow
EnumChildWindows
MessageBoxW
DrawIcon
ExitWindowsEx
LoadIconW
gdi32
CreateCompatibleBitmap
SelectObject
CreateDIBSection
CreateCompatibleDC
PolyBezier
DeleteDC
CreatePen
Ellipse
DeleteObject
CreateSolidBrush
BitBlt
advapi32
AdjustTokenPrivileges
RegCloseKey
RegCreateKeyExW
RegSetValueExW
OpenProcessToken
LookupPrivilegeValueW
winmm
waveOutPrepareHeader
waveOutOpen
waveOutClose
waveOutUnprepareHeader
waveOutWrite
msimg32
AlphaBlend
Name
.text
Size
54KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
58KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
172B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
159KB
Virtual Size
159KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=241, version=40116,
count=120, id=243, version=40116,
count=25, id=242, version=40116,
count=17, id=259, version=24237,
count=29, id=261, version=24237,
count=17, id=260, version=24237,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=124, id=1, productName=Unmarked objects,
count=1, id=265, version=24247,
count=1, id=255, version=24247,
count=1, id=151,
count=1, id=258, version=24247,