SleekBlood[.]asi | Triage™

General

Target
SleekBlood.asi
Size 1.1MB
Sample261027-bb6wbazzbs
SHA256 0e2ec9f5044ee1aa85fecaf7df1a5b5cd2470fdd47f57e89fee0568293734152
MD5 d079ebe4020c90141bb798c7390b70b1
SHA1 71cc2cc33cd41ecee0136ba2abc8cc5e0f9133a0
SHA512 90c46f374acff7b261fc3586eb2c3480e847ffa19ec9b87d3641ead090abfba9136367b136c28a5c168b5c21fa7f72301faf5f5a2475d3e58580bf216be6a7d3
SSDEEP 24576:9KaiXZ2pOhgJEp8BqOpGkzWtRyGQbXVSiKuUBM6sM:9KmqOBzWeGQbXVkuUMVM
TLSH
T1ED357C32EB45A477E43810349D6A5B7B153E95A2077282D73B9829AE8DD07C01F32FDB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SleekBlood.asi

File Explorer

SleekBlood.asi

.dll 1.1MB

SleekBlood.asi

IMPHASH d7349f78ee96e3b8cc6bda717646e5a9
SHA256 0e2ec9f5044ee1aa85fecaf7df1a5b5cd2470fdd47f57e89fee0568293734152
MD5 d079ebe4020c90141bb798c7390b70b1
SHA1 71cc2cc33cd41ecee0136ba2abc8cc5e0f9133a0
SHA512 90c46f374acff7b261fc3586eb2c3480e847ffa19ec9b87d3641ead090abfba9136367b136c28a5c168b5c21fa7f72301faf5f5a2475d3e58580bf216be6a7d3
SSDEEP 24576:9KaiXZ2pOhgJEp8BqOpGkzWtRyGQbXVSiKuUBM6sM:9KmqOBzWeGQbXVkuUMVM
TLSH
T1ED357C32EB45A477E43810349D6A5B7B153E95A2077282D73B9829AE8DD07C01F32FDB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

390963

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetPrivateProfileStringA GetModuleHandleA GetProcAddress VirtualProtect GetModuleFileNameA GetModuleHandleExA GetModuleHandleExW GetModuleFileNameW GetModuleHandleW VirtualFree GetCurrentProcess VirtualAlloc GetCurrentThreadId SuspendThread ResumeThread CloseHandle GetSystemInfo GetThreadContext GetThreadId VirtualQuery SetEndOfFile ReadConsoleW ReadFile HeapReAlloc HeapSize CreateFileW GetConsoleMode ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SwitchToThread QueryPerformanceCounter WakeAllConditionVariable SleepConditionVariableSRW InitializeCriticalSectionEx GetSystemTimeAsFileTime IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwind InterlockedFlushSList RaiseException GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle GetFileType WriteConsoleW ExitProcess HeapFree HeapAlloc WriteFile OutputDebugStringW FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetFileSizeEx SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap GetStringTypeW SetStdHandle FlushFileBuffers GetConsoleOutputCP DecodePointer

user32

GetActiveWindow MessageBoxA

ntdll

NtGetNextThread

Name

.text

Size

517KB

Virtual Size

517KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

533KB

Virtual Size

533KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

46KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

SleekBlood.asi

kernel32

user32

ntdll

generic