Slinky[.]exe | Triage™

General

Target
Slinky.exe
Size 6.0MB
Sample261015-w4rbjsvv5j
SHA256 6f31aa732705463221470095dc696bfdb4fbc8fbddff4690e2e0b5dd32f96eb5
MD5 1e95b97b48a0a8176c2abe66324c315f
SHA1 9857696158bab6bd3758f1a94003f1992cb842e9
SHA512 40ebc79157c1e416b289f23aa456a863910cb80485e01d718cc546555ef0d8f04894f331d2e8838ac40d58ed1693d12c44d2ee515fe0b1081b0a962a0380604a
SSDEEP 98304:rlSsCiUSPX26Zfl/F/5hynzeJG26ZHo/e/5hi8zSQfwoob7AscPDVoJG26ZHo/eV:wtiU1ml/hmnzAOo/aG8zSQ9E7NOo/aG1
TLSH
T1815612153DEC587AD8174231C0608052EF2BB59982C7E05F5A79069F0DAEA8F4F3EBD9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Slinky.exe

File Explorer

Slinky.exe

.exe 6.0MB

Slinky.exe

IMPHASH 8a8fbaa96b96b200aabaaa3a058e4728
SHA256 6f31aa732705463221470095dc696bfdb4fbc8fbddff4690e2e0b5dd32f96eb5
MD5 1e95b97b48a0a8176c2abe66324c315f
SHA1 9857696158bab6bd3758f1a94003f1992cb842e9
SHA512 40ebc79157c1e416b289f23aa456a863910cb80485e01d718cc546555ef0d8f04894f331d2e8838ac40d58ed1693d12c44d2ee515fe0b1081b0a962a0380604a
SSDEEP 98304:rlSsCiUSPX26Zfl/F/5hynzeJG26ZHo/e/5hi8zSQfwoob7AscPDVoJG26ZHo/eV:wtiU1ml/hmnzAOo/aG8zSQ9E7NOo/aG1
TLSH
T1815612153DEC587AD8174231C0608052EF2BB59982C7E05F5A79069F0DAEA8F4F3EBD9
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

31844

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

TranslateMessage LoadIconW LoadCursorW GetWindowThreadProcessId EnumWindows GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW UpdateWindow GetSystemMetrics EnableWindow KillTimer SetTimer IsWindowVisible ShowWindow DestroyWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW SendMessageW DispatchMessageW GetMessageW

gdi32

GetStockObject

kernel32

SetEndOfFile HeapReAlloc HeapSize ReadConsoleW FlushFileBuffers GetStringTypeW SetStdHandle GetProcessHeap FreeEnvironmentStringsW WriteConsoleW MultiByteToWideChar GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetConsoleMode GetConsoleOutputCP GetEnvironmentStringsW SetUnhandledExceptionFilter GetStdHandle GetCommandLineW CreateDirectoryW CreateFileW DeleteFileW GetFileAttributesW GetFileSizeEx GetFileType ReadFile SetFilePointerEx WriteFile GetTempPathW CloseHandle GetLastError WaitForSingleObject Sleep GetCurrentProcessId CreateRemoteThread GetExitCodeThread OpenProcess GetTickCount64 VirtualAllocEx WriteProcessMemory VirtualFreeEx GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource FindResourceW LocalFree FormatMessageW WideCharToMultiByte AllocConsole AttachConsole SetConsoleCtrlHandler SetConsoleOutputCP SetConsoleTitleW GetConsoleWindow CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetModuleFileNameW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect LoadLibraryExW LCMapStringW

Name

.text

Size

136KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

63KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5.7MB

Virtual Size

5.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Slinky.exe

user32

gdi32

kernel32

generic