slinkyloader[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
slinkyloader.exe
Size 18.4MB
Sample260809-rhg4jayhrc
SHA256 cef5b60321f17991400a19072052535638c0a5c02d338234686552deadeea82e
MD5 a2223005e6d186689577e5a2b785a16b
SHA1 1075e177247880d3e1ec940623500bf2e9b275e3
SHA512 073f8e682d2468bfe7d55b82cf0ff5dafd2754da2813de2116551e2811809debba7f06c5d8ed5901a59703bfb306fd5fd05d9d1e797bf9e7887826709c6993c6
SSDEEP 393216:cKRqNWNKROYkhkpXorNv+oXsDS3LNK3HOU6x0pW/lJktSrZPLAB:/ANWKRrpYrNvou7NK3uU6E29dPL
TLSH
T1001733D267D04BD8C353C6BC9583419EF2E27D07D77B8F9B3AC79A020AA1948506BD39
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
slinkyloader.exe

File Explorer

slinkyloader.exe

.exe 18.4MB

slinkyloader.exe

IMPHASH 40d16206c9d6779ad4eec7de1bbc9c0e
SHA256 cef5b60321f17991400a19072052535638c0a5c02d338234686552deadeea82e
MD5 a2223005e6d186689577e5a2b785a16b
SHA1 1075e177247880d3e1ec940623500bf2e9b275e3
SHA512 073f8e682d2468bfe7d55b82cf0ff5dafd2754da2813de2116551e2811809debba7f06c5d8ed5901a59703bfb306fd5fd05d9d1e797bf9e7887826709c6993c6
SSDEEP 393216:cKRqNWNKROYkhkpXorNv+oXsDS3LNK3HOU6x0pW/lJktSrZPLAB:/ANWKRrpYrNvou7NK3uU6E29dPL
TLSH
T1001733D267D04BD8C353C6BC9583419EF2E27D07D77B8F9B3AC79A020AA1948506BD39
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27160

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

SizeofResource SetConsoleTitleA OpenProcess Sleep LockResource CloseHandle LoadResource FindResourceW GetModuleHandleW WriteProcessMemory WaitForSingleObject GetModuleHandleA CreateToolhelp32Snapshot GetExitCodeThread Process32NextW Process32FirstW GetProcAddress VirtualAllocEx CreateRemoteThread lstrcmpiW GetCurrentDirectoryW CreateFileW FindClose FindFirstFileW GetFileAttributesExW AreFileApisANSI GetLastError GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte LocalFree FormatMessageA GetLocaleInfoEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent

msvcp140

?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Xlength_error@std@@YAXPEBD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z _Xtime_get_ticks _Query_perf_counter _Thrd_sleep ?_Syserror_map@std@@YAPEBDH@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __current_exception _CxxThrowException memset __std_terminate __std_exception_copy __std_exception_destroy memcpy __C_specific_handler memmove

api-ms-win-crt-stdio-l1-1-0

ungetc setvbuf fgetpos fwrite _fseeki64 _get_stream_buffer_pointers fsetpos fgetc fclose fflush __acrt_iob_func _set_fmode fputc __p__commode __stdio_common_vfprintf fread

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_cexit __p___argv _crt_atexit _initialize_onexit_table _exit _c_exit _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv exit _set_app_type _seh_filter_exe _register_onexit_function _register_thread_local_exe_atexit_callback _initterm_e terminate system _invalid_parameter_noinfo_noreturn __p___argc

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

api-ms-win-crt-math-l1-1-0

__setusermatherr