slinkyinjector[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
slinkyinjector.exe
Size 98KB
Sample260802-splkza11dv
SHA256 be988c2a54aa46883cafdfb6068e3b77be09dd054aa117f49b7b9e90d324e76f
MD5 d4dd4c8ee2c4642992f77732bc3852e1
SHA1 2f089ed5670d93fed6a485f40dac750bb08e559a
SHA512 6b7e7c2d97f312217ce4f493436e11d4cb59c21c65e2c9f70360f80813a475ccd147795386710b9afe7d25ebebda8008909d83b787abbd29300387ba9fbe4af0
SSDEEP 3072:xPdGIbRRYJTG8xqR8AaP3ZNKkz8rJYB1osWFngD5PxzU:xnvuLxqR8Aahz91os4nMlU
TLSH
T14BA34A4AA3D800E9DCA181B8DA725213E3B1B148576293DF0725C2590FB7BE57F3A398
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
slinkyinjector.exe

File Explorer

slinkyinjector.exe

.exe 98KB

slinkyinjector.exe

IMPHASH 6be0d54d77bd5af43bdc49e77ffdcbb1
SHA256 be988c2a54aa46883cafdfb6068e3b77be09dd054aa117f49b7b9e90d324e76f
MD5 d4dd4c8ee2c4642992f77732bc3852e1
SHA1 2f089ed5670d93fed6a485f40dac750bb08e559a
SHA512 6b7e7c2d97f312217ce4f493436e11d4cb59c21c65e2c9f70360f80813a475ccd147795386710b9afe7d25ebebda8008909d83b787abbd29300387ba9fbe4af0
SSDEEP 3072:xPdGIbRRYJTG8xqR8AaP3ZNKkz8rJYB1osWFngD5PxzU:xnvuLxqR8Aahz91os4nMlU
TLSH
T14BA34A4AA3D800E9DCA181B8DA725213E3B1B148576293DF0725C2590FB7BE57F3A398
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

43824

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\build\ob\bora-20735119\bora-vmsoft\build\release-x64\tools-for-windows\Win32\services\vmtoolsd\vmtoolsd.pdb

advapi32

AllocateAndInitializeSid FreeSid InitializeSecurityDescriptor SetSecurityDescriptorDacl SetSecurityDescriptorOwner SetEntriesInAclW RegCloseKey RegNotifyChangeKeyValue RegOpenKeyExW CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceStatusEx DeregisterEventSource RegisterEventSourceW ReportEventW RegCreateKeyW RegSetValueExW CreateServiceW DeleteService RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW

ole32

CoUninitialize

user32

GetWindowLongPtrW SetWindowLongPtrW GetSystemMetrics UnregisterClassW GetDesktopWindow RegisterDeviceNotificationW UnregisterDeviceNotification MessageBoxW CreateWindowExW DestroyWindow RegisterClassW DefWindowProcW PeekMessageW TranslateMessage DispatchMessageW

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

ws2_32

WSCInstallProvider64_32 WSAStartup WSCEnumProtocols WSACleanup

intl

libintl_gettext

glib-2.0

g_main_loop_run g_main_loop_unref g_source_remove g_timeout_add g_key_file_new g_key_file_free g_key_file_get_keys g_strdup_printf g_strfreev g_strcmp0 g_array_new g_array_free g_array_append_vals g_strchomp g_ptr_array_free g_key_file_get_integer g_ptr_array_remove_index g_ptr_array_add g_ptr_array_sort g_dir_open g_dir_read_name g_dir_close g_file_test g_main_context_default g_main_loop_new g_option_group_set_error_hook g_option_context_get_main_group g_main_context_unref g_stat g_rand_int_range g_rand_free g_rand_new g_key_file_load_from_file g_build_filename g_cond_wait g_get_monotonic_time g_main_loop_quit g_source_destroy g_cond_wait_until g_cond_signal g_snprintf g_atomic_int_add g_queue_new g_atomic_int_set g_key_file_get_boolean g_thread_pool_set_max_idle_time g_thread_pool_set_max_unused_threads g_thread_pool_push g_thread_pool_free g_main_loop_is_running g_thread_pool_new g_queue_delete_link g_queue_remove g_queue_pop_tail g_malloc g_queue_push_head g_queue_find_custom g_queue_free g_option_context_parse g_win32_error_message g_main_loop_get_context g_ptr_array_new g_source_unref g_source_attach g_source_set_callback g_idle_add g_log g_logv g_str_has_prefix g_clear_error g_file_get_contents g_free g_malloc0 g_print g_printerr g_option_context_new g_option_context_set_summary g_option_context_free g_idle_add_full g_mutex_unlock g_mutex_lock g_mutex_clear g_mutex_init g_thread_join g_thread_try_new g_ptr_array_remove g_strdup g_str_has_suffix g_return_if_fail_warning g_option_context_add_main_entries

gmodule-2.0

g_module_open g_module_symbol g_module_make_resident g_module_error g_module_close

gobject-2.0

g_object_notify g_object_class_install_property g_signal_new g_cclosure_marshal_VOID__POINTER g_type_check_class_cast g_type_check_instance_cast g_type_register_static g_type_class_peek_parent g_value_get_boolean g_object_unref g_object_get g_object_set g_object_new g_signal_connect_data g_signal_lookup g_type_init g_signal_emit_by_name g_value_set_boolean g_value_set_uint g_value_get_uint g_value_set_pointer g_value_peek_pointer g_value_get_pointer g_signal_parse_name g_param_spec_pointer

vmtools

File_UnlinkIfExists GuestStoreClient_GetContent VMTools_ConfigGetBoolean VMTools_WriteConfig VMTools_CompareConfig Win32U_RegQueryValueEx Win32U_RegOpenKeyEx BackdoorChannel_New VMTools_CreateTimer RpcChannel_New RpcChannel_SetRetVals RpcChannel_Setup StrUtil_GetNextToken GuestApp_GetConfPath GuestApp_GetInstallPath RpcChannel_RegisterCallback Win32U_FormatMessage Win32U_SetEnvironmentVariable Win32U_GetEnvironmentVariable GuestStoreClient_DeInit GuestStoreClient_Init RpcChannel_Send RpcChannel_Start Str_Snwprintf VMTools_SuspendLogIO File_MakeSafeTemp VMTools_ConfigGetInteger VMTools_AddConfig VMTools_LoadConfig VMTools_GetString VmCheck_IsVirtualWorld Str_SafeAsprintf RpcChannel_SendOne VMTools_BindTextDomain VMTools_TeardownVmxGuestLog VMTools_SetupVmxGuestLog Str_Wcscpy VMTools_UseVmxGuestLog Str_Vaswprintf VMTools_ConfigLogging Str_SafeVaswprintf Str_Aswprintf Hostinfo_GetOSType CodeSet_Utf8ToUtf16le Unicode_InitW Panic RpcChannel_Destroy RpcChannel_Stop VMTools_NewHandleSource Str_Vasprintf VMTools_AttachConsole VMTools_ResumeLogIO vm_free VMTools_ConfigGetString

kernel32

CloseHandle GetLastError SetErrorMode SetEvent WaitForSingleObject CreateEventW GetCurrentProcess GetCurrentThread SetThreadPriority SetPriorityClass GetModuleHandleW GetProcAddress LocalFree SetDllDirectoryW VerifyVersionInfoW SetConsoleCtrlHandler OpenEventW SetLastError ResetEvent Sleep WaitForMultipleObjects LocalAlloc OutputDebugStringA OutputDebugStringW FreeLibrary GetModuleFileNameW LoadLibraryW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter VerSetConditionMask TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strchr _CxxThrowException __std_exception_destroy __std_exception_copy memset __C_specific_handler __current_exception __current_exception_context _purecall

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode malloc free

api-ms-win-crt-runtime-l1-1-0

exit terminate _errno strerror _crt_atexit _seh_filter_exe _set_app_type _configure_wide_argv _initialize_wide_environment _get_initial_wide_environment _initterm _initterm_e _exit __p___argc __p___wargv _cexit _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table _register_onexit_function

api-ms-win-crt-locale-l1-1-0

_configthreadlocale setlocale

api-ms-win-crt-string-l1-1-0

strncmp _wcsicmp strcmp

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __stdio_common_vswprintf _close __stdio_common_vfwprintf __p__commode _set_fmode

api-ms-win-crt-math-l1-1-0

__setusermatherr

generic

count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=4, id=257, version=30034,

count=1, id=253, version=28518,

count=2, id=257, productName=VS2019 v16.11.1 build 30133, version=30133,

count=6, id=257, productName=VS2017 v15.8.4 build 26729, version=26729,

count=2, id=257, productName=VS2019 v16.2.3 build 27905, version=27905,

count=25, id=261, version=30034,

count=10, id=260, version=30034,

count=3, id=259, version=30034,

count=13, id=257, version=28900,

count=317, id=1, productName=Unmarked objects,

count=11, id=260, productName=VS2019 v16.11.1 build 30133, version=30133,

count=2, id=261, productName=VS2019 v16.11.1 build 30133, version=30133,

count=1, id=255, productName=VS2019 v16.11.1 build 30133, version=30133,

count=1, id=151,

count=1, id=258, productName=VS2019 v16.11.1 build 30133, version=30133,