Slinky-Velum[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Slinky-Velum.exe
Size 18.8MB
Sample261003-s644ms1hlb
SHA256 817eb19212450fdae9f8e5305cf9cc06b3dda8958018f1d2d171cff35d76b903
MD5 82172f73c5072f31aeff87a9a43424c5
SHA1 4fad92cdf61b9d314513fcaf35d6b04f716bbd38
SHA512 090502602ed998049747a54afe5607165a4ca2a0b9c2a92c155202c32156b02cdbd2868997ec80902f37188c1e3e6c723460e0dd1731317753d8fb623320ef2f
SSDEEP 393216:iTWVFySLC3y9Vo2YyEig6cZWVAL0xAL2s1DQN4N87qV2HNy:ASeihbm0KqAKHXty
TLSH
T11B1733DBB7D24C5CCB96F3B009A34658AD76F9510398C99F3648C7228C326984DFAF25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Slinky-Velum.exe

File Explorer

Slinky-Velum.exe

.exe 18.8MB

Slinky-Velum.exe

IMPHASH 6f51b64583942a8a99d71ea867d087b7
SHA256 817eb19212450fdae9f8e5305cf9cc06b3dda8958018f1d2d171cff35d76b903
MD5 82172f73c5072f31aeff87a9a43424c5
SHA1 4fad92cdf61b9d314513fcaf35d6b04f716bbd38
SHA512 090502602ed998049747a54afe5607165a4ca2a0b9c2a92c155202c32156b02cdbd2868997ec80902f37188c1e3e6c723460e0dd1731317753d8fb623320ef2f
SSDEEP 393216:iTWVFySLC3y9Vo2YyEig6cZWVAL0xAL2s1DQN4N87qV2HNy:ASeihbm0KqAKHXty
TLSH
T11B1733DBB7D24C5CCB96F3B009A34658AD76F9510398C99F3648C7228C326984DFAF25
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5216

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

ControlTraceW OpenTraceW ProcessTrace StartTraceW

kernel32

CloseHandle CreateDirectoryW CreateFileW CreateRemoteThread CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW EnterCriticalSection FindResourceW FreeLibrary GetCPInfo GetEnvironmentVariableW GetExitCodeThread GetLastError GetLocalTime GetModuleHandleA GetProcAddress GetStdHandle GetTempPathW InitializeCriticalSection LeaveCriticalSection LoadLibraryW LoadResource LocalFree LockResource Module32FirstW Module32NextW MultiByteToWideChar OpenProcess Process32FirstW Process32NextW ReadDirectoryChangesW ReadProcessMemory SetConsoleTextAttribute SetConsoleTitleW SetUnhandledExceptionFilter SizeofResource Sleep TlsGetValue VirtualAllocEx VirtualFreeEx VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteFile WriteProcessMemory lstrcmpiW lstrcpynW

msvcrt

_XcptFilter ___lc_codepage_func ___mb_cur_max_func __iob_func __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _cexit _commode _errno _exit _fmode _getch _initterm _kbhit _lock _unlock _wcslwr _wtoi abort atexit calloc exit fflush fprintf fputc free localeconv malloc memcpy memset setvbuf strerror strlen strncmp system vfprintf wcscat wcscat_s wcscpy wcscpy_s wcslen wcsncpy wcsrchr wcsstr

user32

FindWindowExW GetWindowTextW GetWindowThreadProcessId

Name

.text

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

304B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

296KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

18.7MB

Virtual Size

18.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Slinky-Velum.exe

advapi32

kernel32

msvcrt

user32

generic