release.rar
- SHA256 b9dd74f8f1992ba6f62062a7d4922c02a00826048d6dbe1d30b946de37c52c6e
Overview
overview
5Static
static
5release.rar
windows11-21h2-x64
1protected/Slinky.exe
windows11-21h2-x64
1protected/...in.dll
windows11-21h2-x64
5protected/...sha256
windows11-21h2-x64
3protected/...in.sig
windows11-21h2-x64
3protected/...in.exe
windows11-21h2-x64
1protected/...sha256
windows11-21h2-x64
3protected/...in.sig
windows11-21h2-x64
3protected/...2c.dll
windows11-21h2-x64
1protected/stinky.exe
windows11-21h2-x64
5Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
release.rar
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral2
Sample
protected/Slinky.exe
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral3
Sample
protected/archive/lib_win.dll
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
900 seconds
Behavioral task
behavioral4
Sample
protected/archive/lib_win.sha256
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
900 seconds
Behavioral task
behavioral5
Sample
protected/archive/lib_win.sig
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
900 seconds
Behavioral task
behavioral6
Sample
protected/archive/loader3_win.exe
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral7
Sample
protected/archive/loader3_win.sha256
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
900 seconds
Behavioral task
behavioral8
Sample
protected/archive/loader3_win.sig
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
900 seconds
Behavioral task
behavioral9
Sample
protected/nacre_7f2c.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral10
Sample
protected/stinky.exe
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
900 seconds
General
- Target release.rar
- Size 45.2MB
- Sample260730-van4nawsgy
- SHA256 b9dd74f8f1992ba6f62062a7d4922c02a00826048d6dbe1d30b946de37c52c6e
- MD5 6c60373ec6c4de75481d03a38471ee4e
- SHA1 f88a1587dc95f5f19cb1fc588a8ee261e665ea1c
- SHA512 dafe0daf15306aa1eba132858895e9ebdf2ed380f3723320c21b6a6c2b9e8bbb489b70fb484b603d351fac86e1a157a1ee3932c8fbea39432243153443c9e569
- SSDEEP 786432:4/OhctXlVltaj/IDNsDSa6hMPPw8yJXnct6e6UuIHPO8xeqGtgSMDx4mjeh:zhctF+ApLjqWnnU9P/ItgvUh
- TLSH T190A73383FFEE762BC95BCD19A3429E22A76D768458224B0FA7727214F5B55023C1C273
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Codesign digest Mismatch 1 IoCs
File was altered after it was signed.
resource unpack001/protected/Slinky.exe - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/protected/nacre_7f2c.dll unpack001/protected/stinky.exe - Untrusted Codesign Signers 2 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/protected/archive/lib_win unpack001/protected/archive/loader3_win
File Explorer
-
release.rar.rar 45.2MB
-
protected/Slinky.exe.exe 6.0MB
-
protected/archive/lib_win.dll 21.6MB
-
protected/archive/lib_win.sha25665B
-
protected/archive/lib_win.sig71B
-
protected/archive/loader3_win.exe 6.0MB
-
protected/archive/loader3_win.sha25682B
-
protected/archive/loader3_win.sig72B
-
protected/nacre_7f2c.dll.dll 8.8MB
-
protected/stinky.exe.exe 23.0MB
protected/Slinky.exe
- IMPHASH d42595b695fc008ef2c56aabd8efd68e
- SHA256 3d68c709fb63cc90a01d3aaf2db427edf5c39cbfe42a0499090ce7c3ca67827d
- MD5 029a0878d7b088c182fcd87adc7cf9f4
- SHA1 7f9312aa81b3fb6d5c416907ffecb0b92a11831a
- SHA512 f3e5c35c7934c71417614397975cfe31b90950e873e762056c8a8beff44a9c4de3586b8feba7313aecab370aa7052fc0408bdb035643a85bfe123d3fbd637d5d
- SSDEEP 49152:PsAOFu7Rot3mMIKom+C8eq8+Ns7LlnU09HS4qjtkZOUMjO10o/aufKiK9KvRp5Ep:PpEg/NClnl9yNSLthbJEp
- TLSH T18D564A03ECA545E5C0AAE23589679212BB717C885B3627D32B90F7783F72BD06E79350
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
16:1e:00:0d:9d:67:74:58:96:c6:d8:54:a3:0b:b5:60:6c:df:03:58:24:83:36:44:b6:a4:7e:79:75:85:7f:93
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Slinkware,O=Slinkware,L=Emmeloord,ST=Flevoland,C=NL
Chains
Jan 9, 2026
CN=Slinkware,O=Slinkware,L=Emmeloord,ST=Flevoland,C=NL
Subject
CN=Slinkware,O=Slinkware,L=Emmeloord,ST=Flevoland,C=NL
Serial Number
56:10:62:e9:37:d3:6d:6a:78:e7:bf:69:33:fa:31:b0
Issuer
CN=SSL.com Code Signing Intermediate CA ECC R2,O=SSL Corp,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 10, 2024 - May 10, 2026
Subject
CN=SSL.com Timestamping Unit 2024 E1,O=SSL Corp,L=Houston,ST=Texas,C=US
Serial Number
5a:5a:ac:e8:1a:35:6e:b4:62:86:8d:57:7d:e0:3d:c7
Issuer
CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Feb 19, 2024 - Feb 16, 2034
Subject
CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US
Serial Number
6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56
Issuer
CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 13, 2019 - Nov 12, 2034
Minor OS version
1
Major OS version
6
Entry point
506976
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
PostQueuedCompletionStatus
LoadLibraryW
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler
Name
.text
Size
2.7MB
Virtual Size
2.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2.8MB
Virtual Size
2.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
338KB
Virtual Size
681KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
64KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
53KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
protected/archive/lib_win
- IMPHASH 6d0922214347bf084e9acc7ca9a166e9
- SHA256 be03bbecbf14b03458de36c8b3848c1b7325ad0aeb6a61b6e0f9206fc40b4af7
- MD5 cca3b536cbdf30a01b6f56faaaba4867
- SHA1 8942402a925183da44efce556f844374677a7fa5
- SHA512 862dabf12ceda043b66450bbfa2ec778c9281e303132c57c53b68dd56e24f6f4c9a9ebf6bce973db0410b2e42593eaeecac86aebd66db51a351c477ff3c9f632
- SSDEEP 393216:t1hMVBgt9zH4/o4PXARSt6DXUIbj22gUIEO2r31Zkhbq8PH42ZhZ02/qgmi:t1hMVBgzH4/9QRSIDtbq2JISZWuMPTZ1
- TLSH T1E13722D538D042ACC88BC531E68E2BEEF0D678495DB9681BBFC709012A31D56DCE6937
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
2e:96:f2:56:66:0a:27:4b:f1:35:dd:1e:5b:44:09:31:77:b6:8a:9a:68:35:8a:bf:0c:59:a4:47:1b:6e:59:cd
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Slinkware,O=Slinkware,L=Emmeloord,ST=Flevoland,C=NL
Chains
Jul 26, 2026
CN=Slinkware,O=Slinkware,L=Emmeloord,ST=Flevoland,C=NL
Subject
CN=Slinkware,O=Slinkware,L=Emmeloord,ST=Flevoland,C=NL
Serial Number
56:10:62:e9:37:d3:6d:6a:78:e7:bf:69:33:fa:31:b0
Issuer
CN=SSL.com Code Signing Intermediate CA ECC R2,O=SSL Corp,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 10, 2024 - May 10, 2026
Subject
CN=SSL.com Timestamping Unit 2025 E1,O=SSL Corp,L=Houston,ST=Texas,C=US
Serial Number
1f:6b:16:62:d2:2e:1b:6c:5d:f1:c0:c1:a0:60:0e:38
Issuer
CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Feb 18, 2025 - Nov 12, 2034
Subject
CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US
Serial Number
6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56
Issuer
CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 13, 2019 - Nov 12, 2034
Minor OS version
0
Major OS version
6
Entry point
39189703
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
AcquireSRWLockExclusive
user32
CallWindowProcA
shell32
ShellExecuteW
advapi32
CryptAcquireContextA
api-ms-win-crt-environment-l1-1-0
_wgetenv
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-math-l1-1-0
acos
api-ms-win-crt-runtime-l1-1-0
_errno
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-time-l1-1-0
_gmtime64_s
api-ms-win-crt-utility-l1-1-0
bsearch
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-convert-l1-1-0
mbstowcs_s
api-ms-win-crt-private-l1-1-0
memchr
ws2_32
WSACleanup
iphlpapi
if_nametoindex
crypt32
CertAddCertificateContextToStore
api-ms-win-crt-filesystem-l1-1-0
_fullpath
secur32
InitSecurityInterfaceA
bcrypt
BCryptGenRandom
slinky_init
Name
.text
Size
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.buildid
Size
Virtual Size
28B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
133KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
Virtual Size
288B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.slinky0
Size
Virtual Size
13.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.slinky1
Size
1024B
Virtual Size
672B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.slinky2
Size
21.6MB
Virtual Size
21.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
156B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
protected/archive/lib_win.sha256
- SHA256 5a6aceb05ecf870a71ce005df609517ccbf80d239b8d814b2baff393c39b4808
- MD5 d8a55ddda3045a6ea6ee616e19165d7e
- SHA1 89e0522a65b5170191307877283d26dd81a7267f
- SHA512 affa29cfc42a5d6a602db97c2f41c30488490bd978b956d6fe15243f7357125880b3d13bc8f44e0117d6e61d260fc14f8623bfbfac23efb81edc57d56fdc8267
- TLSH T1D0A00252D9056641AA193764360D033A2A858A515C137EA693A169FE369B231E0E4750
- MD5 SHA1 SHA512 TLSH
protected/archive/lib_win.sig
- SHA256 4929f0a9fe6d2b9c462d12a03442b4b257b0b1851bd1d7421ff3e4317bad17f1
- MD5 78a9831d8463d054e04bab1c821b7a92
- SHA1 ede53e39267e40fd73cd2d394fa9f8da873213c1
- SHA512 4724dfcaba64be2aa5c54dc41f8ac08819a694e2eb4dcf889a875ae84e8412902de991759cfa12f2108dabefaa8f4ecfa1662406a60eea5d34879bad82f366c7
- TLSH T12CA0223C2A2C20222280C03A338808AEC822C0A38000F0CE203022F0CCCC30308B30A0
- MD5 SHA1 SHA512 TLSH
protected/archive/loader3_win
- IMPHASH d42595b695fc008ef2c56aabd8efd68e
- SHA256 f93345c0cfe60e5fce7d8d84ad23043cfcdd2c9516791309215bc9a005ee4e95
- MD5 0a3f1c2d04bc0d6183b4919628e08a86
- SHA1 af161fd596ebbab8dd723d6d70b81f1cd8b59ae6
- SHA512 493f4d5ece050109ce9acd77c09e75177dabf917187b08a12676278ccd687867ad6078b489fc154e9bcbe7a7aa8871097bf53d79ab63035348eb738bde96f278
- SSDEEP 49152:PsAOFu7Rot3mMIKom+C8eq8+Ns7LlnU09HS4qj+kZOUMjO10o/aufKiK9KvRp5EZ:PpEg/NClnl9yeSLthbJEZ
- TLSH T167564A03ECA545E5C0AAE23589679212BB717C885B3627D32B90F7783F72BD06E79350
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
ac:7b:ca:e6:f9:73:c5:0c:c1:0e:4b:a7:d2:63:49:94:c0:05:43:5f:af:1f:d6:9f:f0:0d:26:37:7f:ce:24:94
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Slinkware,O=Slinkware,L=Emmeloord,ST=Flevoland,C=NL
Chains
Jan 9, 2026
CN=Slinkware,O=Slinkware,L=Emmeloord,ST=Flevoland,C=NL
Subject
CN=Slinkware,O=Slinkware,L=Emmeloord,ST=Flevoland,C=NL
Serial Number
56:10:62:e9:37:d3:6d:6a:78:e7:bf:69:33:fa:31:b0
Issuer
CN=SSL.com Code Signing Intermediate CA ECC R2,O=SSL Corp,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 10, 2024 - May 10, 2026
Subject
CN=SSL.com Timestamping Unit 2024 E1,O=SSL Corp,L=Houston,ST=Texas,C=US
Serial Number
5a:5a:ac:e8:1a:35:6e:b4:62:86:8d:57:7d:e0:3d:c7
Issuer
CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Feb 19, 2024 - Feb 16, 2034
Subject
CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US
Serial Number
6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56
Issuer
CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 13, 2019 - Nov 12, 2034
Minor OS version
1
Major OS version
6
Entry point
506976
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
PostQueuedCompletionStatus
LoadLibraryW
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler
Name
.text
Size
2.7MB
Virtual Size
2.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2.8MB
Virtual Size
2.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
338KB
Virtual Size
681KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
64KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
53KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
protected/archive/loader3_win.sha256
- SHA256 b4442b4f64f6ab7ad6b694c932dee25a5d7426b0018d1842ac6578b1f009fb2a
- MD5 aa1d294237c55d0e1bf07db6c0b5ee7f
- SHA1 035cad502c0fe26415295816761cc5832c7d58f4
- SHA512 46c01ff4c9bc06dc706db75fbe25204c41c293501a4d7e9e80a0ac0d834229df0c5cf469c1309106cc2d2bc63ffdda2212675bef172e198b9cfb9f74b558214c
- TLSH T196A012068124D8060509262512190D4177802D17A100680745104099A202E0C97C6136
- MD5 SHA1 SHA512 TLSH
protected/archive/loader3_win.sig
- SHA256 86d9d92de79a00fab75dcf7799184af028c5268f9041a8cda5c86b8421427650
- MD5 ef7fe63d71674138bf0b2ecd8b7955aa
- SHA1 1f6a5c5d970aa0aab7fe2d326f158b77f267480f
- SHA512 cd474c880ddcc58b682cef70717053625515d9feb78c38df297d79c5e4c0278a8b55248c2b9b3dc4f6a3d08091e6928bb54f16ae6e801f1276d57763c79ae309
- TLSH T1B5A022082008BCC303B280A203A0CC0020B820A8E0C80000BC0C0320300CE82E0C2C03
- MD5 SHA1 SHA512 TLSH
protected/nacre_7f2c.dll
- IMPHASH 06e29fc3db053fb5a76c87e45ae4759f
- SHA256 044f64c5a19e365b9994e862d710ec37aca8475ddb64270238b16e988257f8e1
- MD5 29f5b2dd6612c316ee355fbc4bc8eab9
- SHA1 20b9f68f1cc082d0a4013038ec399bea43f316ea
- SHA512 5601d6bfb4f997764abc5b0e0d95f4a9f0878e59601b996411f9a7d19a22ef46ed97f91e9e0639f77e5ac3b69aafb429f21aa4b4932ea5ab8f1b066bbce3713b
- SSDEEP 98304:YzEAfZSUwLn4Wf+O+PMYuWbj2naqxZiDF8xHgrHPoyPZm9KQpE6j:YzzfZSUwLn/xYuWzqxZiDF8x/H9EG
- TLSH T12896E0A9A5BC0079E467857CC28B2266EBB1B4290BF017DF2F9445E51F33FD096BA710
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
3203344
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
advapi32
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
SystemFunction036
crypt32
CertOpenSystemStoreW
CertGetCertificateContextProperty
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
winhttp
WinHttpCloseHandle
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpSetOption
WinHttpSetTimeouts
WinHttpOpenRequest
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpConnect
WinHttpOpen
ws2_32
getservbyport
gethostbyaddr
inet_ntoa
inet_addr
htons
htonl
gethostbyname
getsockopt
getsockname
ioctlsocket
WSAGetLastError
WSASetLastError
send
recv
WSACleanup
WSAStartup
getservbyname
closesocket
connect
setsockopt
socket
shutdown
getpeername
recvfrom
ntohs
sendto
select
kernel32
SetEndOfFile
WriteConsoleW
HeapSize
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
HeapReAlloc
SetFilePointerEx
GetFileSizeEx
GetConsoleOutputCP
FlushFileBuffers
LCMapStringW
CompareStringW
LoadLibraryExW
HeapAlloc
HeapFree
UnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
IsProcessorFeaturePresent
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileInformationByHandle
GetDriveTypeW
CreateFileW
SetConsoleCtrlHandler
TerminateProcess
ExitProcess
SetStdHandle
CloseHandle
SetLastError
AddVectoredExceptionHandler
SetEvent
CreateEventW
Sleep
GetCurrentProcessId
CreateThread
GetCurrentThreadId
OpenThread
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
DisableThreadLibraryCalls
CreateToolhelp32Snapshot
Thread32First
Thread32Next
Module32FirstW
Module32NextW
GetEnvironmentVariableW
GetLastError
GetCurrentProcess
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetFileType
GetStdHandle
WriteFile
GetModuleHandleW
GetProcAddress
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ReleaseSemaphore
WaitForSingleObject
GetExitCodeThread
CreateSemaphoreA
GetSystemDirectoryA
FreeLibrary
LoadLibraryA
FormatMessageA
VirtualProtect
VirtualFree
GetModuleHandleExW
GetACP
GetSystemTimeAsFileTime
RtlVirtualUnwind
GetSystemTime
SystemTimeToFileTime
LoadLibraryW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
FindClose
FindFirstFileW
FindNextFileW
ReadFile
FreeLibraryAndExitThread
ExitThread
FlsFree
FlsSetValue
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimePreciseAsFileTime
WaitForSingleObjectEx
TryAcquireSRWLockExclusive
GetCurrentDirectoryW
FindFirstFileExW
GetFullPathNameW
WakeAllConditionVariable
InitializeCriticalSectionEx
EncodePointer
DecodePointer
GetStringTypeW
GetCPInfo
SetUnhandledExceptionFilter
GetStartupInfoW
InitializeSListHead
RtlPcToFileHeader
RaiseException
RtlUnwindEx
RtlLookupFunctionEntry
InterlockedFlushSList
FlsAlloc
FlsGetValue
user32
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
StinkyConfigure
Name
.text
Size
3.2MB
Virtual Size
3.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
21KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
141KB
Virtual Size
140KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.r4k80
Size
4.1MB
Virtual Size
4.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
469B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
protected/stinky.exe
- IMPHASH b9af1d5c6202786564b31882c5b54ce5
- SHA256 4fb030b137047c127b134051efb187c44b4fc13308cbb8c0dfb94de2627094ae
- MD5 9f2c5ed3edd22492748e946533df0edc
- SHA1 3b3f4cc501ceb0027ef80a646d43db2c31639d9d
- SHA512 e30e463f14e0f85175e620c56c567c382a9d5c8329448ef8d3133be99772ff4ec14d7c66421b4f08d4ea982ce8718cf083e2442ab752a80c148919e33e8d755f
- SSDEEP 393216:O2uL8awiLSKtiAT51av8CIeSmS80v7qnQxkoJp9sObdBzWt5KYv/U:O2ugaw5KtiVv8CyvenQyoJfbP
- TLSH T19E3712C678E191ECD397CA30D7CA6AF8D2DA768A0CB9542F6FCA04022631D51CDE5D36
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
20980352
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
advapi32
OpenProcessToken
bcrypt
BCryptGenRandom
crypt32
CertOpenSystemStoreW
shell32
ShellExecuteW
user32
GetClipboardData
winhttp
WinHttpOpen
wintrust
WTHelperGetProvSignerFromChain
ws2_32
getpeername
kernel32
SetEndOfFile
Name
.text
Size
Virtual Size
4.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
189KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.q7m20
Size
Virtual Size
13.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.q7m21
Size
512B
Virtual Size
200B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.q7m22
Size
23.0MB
Virtual Size
23.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
184B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ