salinewin.zip
- SHA256 b3020dd6c9ffceaba72c465c8d596cf04e2d7388b4fd58f10d78be6b91a7e99d
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
salinewin-safety.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
salinewin.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
6 signatures
150 seconds
General
- Target salinewin.zip
- Size 203KB
- Sample260808-xffetaxsd1
- SHA256 b3020dd6c9ffceaba72c465c8d596cf04e2d7388b4fd58f10d78be6b91a7e99d
- MD5 19a966f0b86c67659b15364e89f3748b
- SHA1 94075399f5f8c6f73258024bf442c0bf8600d52b
- SHA512 60a926114d21e43c867187c6890dd1b4809c855a8011fcc921e6c20b6d1fb274c2e417747f1eef0d64919bc4f3a9b6a7725c87240c20b70e87a5ff6eba563427
- SSDEEP 6144:AX0xX7MnBGkuOtEZlwuO2lJwz7EeQG+YSGL:AWXKuVZQ27oEhVYbL
- TLSH T1DF142306C25025CBACEE660704F4D13218A34F5FFB5079ABD26B64E95FA1FA01D84B8F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/salinewin-safety.exe unpack001/salinewin.exe
File Explorer
-
salinewin.zip.zip 203KB
-
readme.txt318B
-
salinewin-safety.exe.exe 245KB
-
salinewin.exe.exe 283KB
readme.txt
- SHA256 a56b31136f7a822ca4e01d17728e1683989e440e6ccff7bf1ca0f282ef521648
- MD5 d066989e7c3329ceee99b4461a31cad6
- SHA1 aba6ba54cfb19ac454bad9b18e75b86be1f8d625
- SHA512 2c9388f87a4b3a3582697b968d70463194c7475ae5502790299c4030762f09e6581e38b5c52fe0202bf61862cec6fd0e988c9f0689a78fa564c4b744c5be4e47
- TLSH T144E07D3B7208B3F2EB4400571E7E14A7E36C91AA37FB3F1A58037181274114953AA844
- MD5 SHA1 SHA512 TLSH
salinewin-safety.exe
- IMPHASH 9f7f10edbd91c09f566c53cb56dca59b
- SHA256 279a19315055e93a80c558bf9d9a7c8b4aba8fc8f8f3e812df8619e959abbcae
- MD5 601283c004aa6e4bcebfb6e844eb653c
- SHA1 9c3dde5abd1056497f03f5ae5a3dc6ffed1028cf
- SHA512 feeaebc7c097c724f0cea539729729a7512eb0c75c45b7395cd1d7b3ab643f11fb8b941373b30b12d14b837ff53793fdf49fd70f524c9f6391285d62cf4a7c06
- SSDEEP 3072:0Rz5n9Sae432oSLsMT3myjTvoTboVEBZP5pHQpYR95WPNp1wH:0T64a74LZPPHQpY35WPNpW
- TLSH T1C6348D21B5C1C5F1F97945356826C9910E6AFC369F500EAF3298332F0E761E2453BEAE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
12890
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\ACER\source\repos\salinewin-safety\Release\salinewin-safety.pdb
kernel32
GetConsoleCP
GetConsoleMode
HeapReAlloc
SetFilePointerEx
WriteConsoleW
DecodePointer
CreateFileW
CreateThread
CloseHandle
TerminateThread
FlushFileBuffers
Sleep
HeapSize
GetProcessHeap
GetStringTypeW
GetFileType
SetStdHandle
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetACP
HeapFree
HeapAlloc
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
CompareStringW
LCMapStringW
RaiseException
user32
GetCursorPos
ReleaseDC
InvalidateRect
GetDesktopWindow
LoadIconW
GetDC
GetSystemMetrics
DrawIcon
gdi32
SelectObject
CreateDIBSection
CreateCompatibleDC
PolyBezier
DeleteDC
CreatePen
Ellipse
DeleteObject
CreateSolidBrush
BitBlt
winmm
waveOutOpen
waveOutClose
waveOutUnprepareHeader
waveOutWrite
waveOutPrepareHeader
Name
.text
Size
53KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
172B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
159KB
Virtual Size
158KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=241, version=40116,
count=120, id=243, version=40116,
count=25, id=242, version=40116,
count=17, id=259, version=24237,
count=29, id=261, version=24237,
count=17, id=260, version=24237,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=109, id=1, productName=Unmarked objects,
count=1, id=265, version=24245,
count=1, id=255, version=24245,
count=1, id=151,
count=1, id=258, version=24245,
salinewin.exe
- IMPHASH c9b441367974f8bcdb3c75cfd640f1a7
- SHA256 7163fefbf2f865ef78a2d3d4480532fffb979300d6f0a77b6f3fc5c4b0d2cada
- MD5 2b1e9226d7e1015552a21faca891ec41
- SHA1 f87fcbe10fa9312048214d4473498ad4f9f331ce
- SHA512 1852f6d05c9fca962178bc190bc8c90f0ca54ea99714480690f44417e49eee6c392579091ae8a6cd053ec47ad1980dbbbc0db3e0e00520ee1bdbadbf8dc9d69e
- SSDEEP 3072:HZVUJ58IAelkapH3shY6iEwgaBZP5pHQpYR95WPNpNMl3:nUJ5PzB5ZPPHQpY35WPNpGl3
- TLSH T10F547C10B5C0C4F1F87545366836CA910E6DFD399E601EAF3298736F0E751E2463BE6A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
13314
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\ACER\source\repos\salinewin\Release\salinewin.pdb
kernel32
DecodePointer
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapReAlloc
HeapSize
GetProcessHeap
GetStringTypeW
GetFileType
ExitProcess
GetProcAddress
CreateThread
LoadLibraryW
CloseHandle
TerminateThread
Sleep
CreateFileW
WriteFile
FlushFileBuffers
SetStdHandle
LCMapStringW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetACP
HeapFree
HeapAlloc
WaitForSingleObject
GetExitCodeProcess
CreateProcessA
GetFileAttributesExW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
CompareStringW
RaiseException
user32
GetCursorPos
ReleaseDC
SetCursorPos
InvalidateRect
GetDesktopWindow
SendMessageTimeoutW
GetDC
MessageBoxW
EnumChildWindows
GetSystemMetrics
DrawIcon
LoadIconW
gdi32
SelectObject
CreateDIBSection
CreateCompatibleDC
PolyBezier
DeleteDC
CreatePen
Ellipse
DeleteObject
CreateSolidBrush
BitBlt
winmm
waveOutOpen
waveOutClose
waveOutUnprepareHeader
waveOutWrite
waveOutPrepareHeader
Name
.text
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
58KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
172B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
159KB
Virtual Size
159KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=241, version=40116,
count=131, id=243, version=40116,
count=25, id=242, version=40116,
count=17, id=259, version=24237,
count=29, id=261, version=24237,
count=18, id=260, version=24237,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=120, id=1, productName=Unmarked objects,
count=1, id=265, version=24245,
count=1, id=255, version=24245,
count=1, id=151,
count=1, id=258, version=24245,