slui[.]exe | Triage™

Resubmissions

11/07/2026, 04:41

260711-fbgcwad12t3

11/07/2026, 04:24

260711-e1hrkabv8j3

Sharing

Copy URL Twitter E-mail

General

Target
slui.exe
Size 680KB
Sample260711-e1hrkabv8j
SHA256 cd8bcad9ca8bc2434953bc7aed0c74857c24ebb334b7e0971ee82fcc8ab826c6
MD5 644421240c1d9733238f435a97ad9e66
SHA1 1333b7b86986bf7c65323d58ff2f93b33116f712
SHA512 42ed7b7d260f70610e861a891145196ca03cb2ff356fd7d6cd503b0642ba0df8a2482e3ea6ffeffe73c5c66a04487b1b24dec94bb78f5ca3d1658e4c7886e204
SSDEEP 12288:6pqx6ghLVNL7fhUy9fQ3qZnoD3/NIW6HOflf3ek4dCMX/cRyusvXXcIwtFlYC1c4:wghLVNL7pUy9foKnob/NIW1flPevHusd
TLSH
T1A3E49D1C33D850E8C2364538C9534757D9B17828233325EB23E1E57D6B6AAEC66BEF42
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
slui.exe

File Explorer

slui.exe

.exe 680KB

slui.exe

IMPHASH 41927116e35bed16b3ab058c4cd93463
SHA256 cd8bcad9ca8bc2434953bc7aed0c74857c24ebb334b7e0971ee82fcc8ab826c6
MD5 644421240c1d9733238f435a97ad9e66
SHA1 1333b7b86986bf7c65323d58ff2f93b33116f712
SHA512 42ed7b7d260f70610e861a891145196ca03cb2ff356fd7d6cd503b0642ba0df8a2482e3ea6ffeffe73c5c66a04487b1b24dec94bb78f5ca3d1658e4c7886e204
SSDEEP 12288:6pqx6ghLVNL7fhUy9fQ3qZnoD3/NIW6HOflf3ek4dCMX/cRyusvXXcIwtFlYC1c4:wghLVNL7pUy9foKnob/NIW1flPevHusd
TLSH
T1A3E49D1C33D850E8C2364538C9534757D9B17828233325EB23E1E57D6B6AAEC66BEF42
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

slui.pdb

advapi32

EventWriteTransfer RegCloseKey RegQueryValueExW RegOpenKeyExW ReportEventW RegisterEventSourceW DeregisterEventSource RegSetValueExW RegQueryInfoKeyW RegEnumKeyW RegDeleteKeyW RegCreateKeyExW EventUnregister EventRegister CheckTokenMembership AllocateAndInitializeSid FreeSid

kernel32

HeapFree GetModuleHandleExW CloseHandle HeapAlloc GetProcAddress GetProcessHeap GetLastError InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection FileTimeToSystemTime DeleteCriticalSection EncodePointer GetCurrentThreadId RaiseException WaitForSingleObject ReleaseSemaphore SetEvent Sleep FormatMessageW GetModuleHandleW GetModuleFileNameA DebugBreak IsDebuggerPresent OutputDebugStringW SetLastError ReleaseMutex WaitForSingleObjectEx OpenSemaphoreW RegisterApplicationRestart HeapSetInformation GetCommandLineW GetCurrentProcessId CreateMutexExW CreateEventW CreateSemaphoreExW LocalFree DecodePointer GetModuleFileNameW VirtualQuery InitializeCriticalSection SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer AcquireSRWLockExclusive AcquireSRWLockShared InitializeCriticalSectionEx ReleaseSRWLockExclusive ReleaseSRWLockShared CreateThreadpoolTimer ExpandEnvironmentStringsW GetFileAttributesW SystemTimeToFileTime GetSystemTime LockResource LoadResource FindResourceExW GetDateFormatEx LocalAlloc FreeLibrary LoadLibraryExW GetCurrentProcess CheckElevationEnabled GetSystemDirectoryW WaitForMultipleObjects CreateSemaphoreW FreeLibraryAndExitThread GetCurrentThread SetThreadPriority CreateThread GetThreadPriority GetProcessAffinityMask GetUserDefaultLCID

user32

SetWindowLongPtrW AllowSetForegroundWindow LoadCursorW SetCursor CallWindowProcW GetWindowLongPtrW CreateWindowExW GetDesktopWindow GetWindowLongW RegisterClassW DefWindowProcW SetForegroundWindow MessageBoxW DestroyWindow

msvcrt

memmove __dllonexit _amsg_exit _XcptFilter _cexit memset __getmainargs ?terminate@@YAXXZ exit _exit __C_specific_handler _initterm __setusermatherr _ismbblead _unlock _lock _waccess_s wcschr memcpy memcmp __set_app_type _onexit wcsstr _wtoi swscanf_s memmove_s towupper _wcsicmp memcpy_s _purecall _vsnwprintf _commode _fmode _acmdln wcscmp

api-ms-win-core-com-l1-1-0

CoInitializeEx CoReleaseServerProcess CoSuspendClassObjects CoMarshalInterThreadInterfaceInStream CoCreateInstance StringFromGUID2 CoTaskMemAlloc CoTaskMemFree CoGetInterfaceAndReleaseStream CoResumeClassObjects CoRegisterClassObject CoRevokeClassObject PropVariantClear CoUninitialize CoAddRefServerProcess CoInitializeSecurity

oleaut32

SystemTimeToVariantTime VariantTimeToSystemTime UnRegisterTypeLi SysAllocString SysFreeString LoadTypeLi RegisterTypeLi

rpcrt4

I_RpcMapWin32Status RpcStringFreeW UuidToStringW

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString WindowsGetStringRawBuffer WindowsCreateStringReference

api-ms-win-core-processthreads-l1-1-0

GetStartupInfoW TerminateProcess

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry RtlVirtualUnwind RtlCaptureContext

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter UnhandledExceptionFilter

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable SleepConditionVariableSRW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime GetTickCount

api-ms-win-core-processthreads-l1-1-1

GetProcessMitigationPolicy

winbrand

BrandingLoadString

ntdll

WinSqmSetDWORD

ole32

MkParseDisplayName CreateBindCtx

shell32

ShellExecuteExW CommandLineToArgvW

sppc

SLClose SLOpen SLpIsCurrentInstalledProductKeyDefaultKey SLGetGenuineInformation

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory

slc

SLConsumeWindowsRight

Name

.text

Size

392KB

Virtual Size

391KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

fothk

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

228KB

Virtual Size

224KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

600B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

slui.exe

advapi32

kernel32

user32

msvcrt

api-ms-win-core-com-l1-1-0

oleaut32

rpcrt4

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-processthreads-l1-1-1

winbrand

ntdll

ole32

shell32

sppc

wtsapi32

slc

generic