slinky (1) (1).rar
- SHA256 0c8f565247adb4fcf5be16a263e452979c473c172f4e26fe31cc818bbe70297b
Overview
overview
7Static
static
3slinky (1) (1).rar
windows10-2004-x64
1slinky (1) (1).rar
windows11-ltsc_2024-x64
1COPYRIGHT
windows10-2004-x64
3COPYRIGHT
windows11-ltsc_2024-x64
3jmc.txt
windows10-2004-x64
1jmc.txt
windows11-ltsc_2024-x64
1jvisualvm.txt
windows10-2004-x64
1jvisualvm.txt
windows11-ltsc_2024-x64
1sqare.exe
windows10-2004-x64
7sqare.exe
windows11-ltsc_2024-x64
7Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
slinky (1) (1).rar
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
slinky (1) (1).rar
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
COPYRIGHT
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
COPYRIGHT
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
jmc.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
jmc.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
jvisualvm.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
jvisualvm.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
sqare.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target slinky (1) (1).rar
- Size 555KB
- Sample260801-sdzy8a1zdz
- SHA256 0c8f565247adb4fcf5be16a263e452979c473c172f4e26fe31cc818bbe70297b
- MD5 53745992a8d1d4213f5fb891ef08be79
- SHA1 734805584786ad5ba2d5157f5e86b782e327ec63
- SHA512 140d36c2399ae947ce954bc2dc0bbd58db3fc8d0afe88ee8388f1ec90958d5160a22aebff33f7ca74b7c1781ff102dadb6264ce5691e7d11d27a0c51cedc725c
- SSDEEP 12288:2PQ4Ev4UVD5rwjeOlcCU9Pwi6MEoWEOl1RByfw2sU8bfs98I31Ts7oV:jBJ5rWelj9YiDnOzRw17BTs4
- TLSH T1E5C423B092BFEFD0F87B8B89EE1B86811A15E7BF026460E05558FACDD8913F349B5114
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/sqare.exe
File Explorer
-
slinky (1) (1).rar.rar 555KB
-
COPYRIGHT3KB
-
jmc.txt195B
-
jvisualvm.txt180B
-
sqare.exe.exe 1.1MB
COPYRIGHT
- SHA256 6af2199047ce21b763edb2d0c494a113a2c24371a545c17221f7c8ad66e605ff
- MD5 6aa4d2c892b1a12df6ecbd8408a10a73
- SHA1 370943ea0052b05066e5ac4a90c61fe565f43e0b
- SHA512 7f33f0237ee736daf5bf7e449aa3e9013d41a098db6fd06bd88c3e3ed58af831df4acafa401f705c36edb25293f5cc7834284de0237e3c5392ab4f7c994c93f5
- TLSH T1CB6173ABF35417A20AD302B7750558ECEF2B99FCB37904A63E5E805C2256C98533F326
- MD5 SHA1 SHA512 TLSH
jmc.txt
- SHA256 63e677e13fbb51b6076e3a3f3a020907d65b4ce282a443dcb3fc554129409b29
- MD5 b211638519c96f73a94831679ba9072b
- SHA1 7d10fd57df03a2665bacee5d1ceb26becc06c700
- SHA512 bdd284ff255e715e1c8e95702519c3a94d4606839f8e1bcb36f238b82f2fdf044f4a01f61f02c0f90ebe2163f2dac8b288079591adf1b877ca378f2e349ef39a
- TLSH T1EFD0228F8A88A172140182852826B342CF3A7051200442824C6C44A7206AE7DE32742C
- MD5 SHA1 SHA512 TLSH
jvisualvm.txt
- SHA256 5d3f49e0fdaa05ee9e81ec111b39f5e7090c8479572658ecde40282c66096b0b
- MD5 67b46f78cd25d67a9cafeb6a99c535ed
- SHA1 8a218eac05367583b1508cc35b16a73868a8aeb8
- SHA512 b3ca2a44aa7dfcdaa617e826e1f0472db01786df354b2e0a9a7b9f9ac933fcbaaa598d7975a23135d1ebaa1ed9a205d7f0bd7d46c71fb9c35b8cddd39b126287
- TLSH T1B0C080CFC10C5572106547C0440673C1DB267245175453CD4C6E0157D046A99D35F96D
- MD5 SHA1 SHA512 TLSH
sqare.exe
- IMPHASH 3791962f7492f014d3ff166e0236f167
- SHA256 3b82622eae8d7377ffb1878868413cfaf25b1e53f8ee5c907eb6539b2bf0aa4a
- MD5 92604cfbdfb5e1f60eed0149729c2a98
- SHA1 d3d900d3f8b1b9bf7f947f0d8f2f98b38ebc7211
- SHA512 dd74ee4ba0078a74da4e1eaf2b3fd39f948c34fa68c7f0662f71bdddce7f873f44a10f987e9dce35e5ebe4eb67d08199775be6a5f6b5b6fdc9436fbc1627ad50
- SSDEEP 24576:NNo8PUrjpgt9TQrTRIbM68YZwmSJmKh3vjhkChq:NNot3pgt9srKo68YZwnmKVjht
- TLSH T1A7457C56BA66D0FCC46EC0B5C75A5673BF21B84A0B317AEB41D056383E66EE02B3D704
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
734432
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
SwitchToThread
WaitForMultipleObjects
GetExitCodeProcess
CreateProcessW
ReadFile
GetOverlappedResult
Sleep
FindNextFileW
CreateEventW
GetExitCodeThread
CreateIoCompletionPort
PostQueuedCompletionStatus
CreateDirectoryW
GetFileInformationByHandleEx
GetFileInformationByHandle
FindClose
CancelIo
SetFilePointerEx
GetProcessHeap
HeapFree
AddVectoredExceptionHandler
HeapReAlloc
GetFileAttributesW
FindFirstFileExW
GetCurrentDirectoryW
RtlCaptureContext
DuplicateHandle
LoadLibraryA
GetProcAddress
lstrlenW
SetWaitableTimer
WideCharToMultiByte
GetStdHandle
GetConsoleMode
GetConsoleOutputCP
MultiByteToWideChar
WriteConsoleW
HeapAlloc
GetEnvironmentVariableW
QueryPerformanceFrequency
GetModuleHandleW
FormatMessageW
QueryPerformanceCounter
GetModuleHandleA
CompareStringOrdinal
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateFileMappingW
GetSystemInfo
MapViewOfFile
UnmapViewOfFile
VirtualProtect
GetSystemTimePreciseAsFileTime
RtlLookupFunctionEntry
SetFileInformationByHandle
SetFileTime
CreateFileW
GetFullPathNameW
CreateThread
SetHandleInformation
CreateWaitableTimerExW
DeleteFileW
WriteFileEx
SleepEx
ReadFileEx
WaitForSingleObject
RtlVirtualUnwind
ReleaseMutex
CreateMutexA
GetCurrentProcessId
GetCurrentProcess
WaitForSingleObjectEx
SetLastError
GetCurrentThreadId
CloseHandle
GetLastError
GetQueuedCompletionStatusEx
GetSystemTimeAsFileTime
InitializeSListHead
GetCurrentThread
GetTempPathW
SetThreadStackGuarantee
SetUnhandledExceptionFilter
ntdll
RtlNtStatusToDosError
NtDeviceIoControlFile
NtCancelIoFileEx
NtWriteFile
NtReadFile
NtOpenFile
NtCreateNamedPipeFile
api-ms-win-core-synch-l1-2-0
WakeByAddressSingle
WakeByAddressAll
WaitOnAddress
ws2_32
recv
getaddrinfo
connect
send
ioctlsocket
closesocket
WSAGetLastError
WSASocketW
WSACleanup
WSAStartup
select
getsockopt
setsockopt
freeaddrinfo
bcryptprimitives
ProcessPrng
bcrypt
BCryptGenRandom
advapi32
SystemFunction036
vcruntime140
__current_exception_context
__current_exception
__CxxFrameHandler3
memcpy
__C_specific_handler
memset
memcmp
memmove
api-ms-win-crt-string-l1-1-0
strlen
api-ms-win-crt-math-l1-1-0
pow
cosf
sinf
__setusermatherr
sin
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
_configure_narrow_argv
_initterm
_initterm_e
__p___argv
exit
_exit
_cexit
__p___argc
_c_exit
_set_app_type
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_get_initial_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
free
_set_new_mode
Name
.text
Size
789KB
Virtual Size
788KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
341KB
Virtual Size
340KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35403,
count=3, id=259, version=35403,
count=9, id=260, version=35403,
count=23, id=261, version=35403,
count=155, id=1, productName=Unmarked objects,
count=23, productName=Unmarked objects (old),
count=1, id=255, version=35725,
count=1, id=258, version=35725,