salinewin-safety[.]exe

General

Target
salinewin-safety.exe
Size 245KB
Sample261107-lybnssa13s
SHA256 279a19315055e93a80c558bf9d9a7c8b4aba8fc8f8f3e812df8619e959abbcae
MD5 601283c004aa6e4bcebfb6e844eb653c
SHA1 9c3dde5abd1056497f03f5ae5a3dc6ffed1028cf
SHA512 feeaebc7c097c724f0cea539729729a7512eb0c75c45b7395cd1d7b3ab643f11fb8b941373b30b12d14b837ff53793fdf49fd70f524c9f6391285d62cf4a7c06
SSDEEP 3072:0Rz5n9Sae432oSLsMT3myjTvoTboVEBZP5pHQpYR95WPNp1wH:0T64a74LZPPHQpY35WPNpW
TLSH
T1C6348D21B5C1C5F1F97945356826C9910E6AFC369F500EAF3298332F0E761E2453BEAE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
salinewin-safety.exe

File Explorer

salinewin-safety.exe

.exe 245KB

salinewin-safety.exe

IMPHASH 9f7f10edbd91c09f566c53cb56dca59b
SHA256 279a19315055e93a80c558bf9d9a7c8b4aba8fc8f8f3e812df8619e959abbcae
MD5 601283c004aa6e4bcebfb6e844eb653c
SHA1 9c3dde5abd1056497f03f5ae5a3dc6ffed1028cf
SHA512 feeaebc7c097c724f0cea539729729a7512eb0c75c45b7395cd1d7b3ab643f11fb8b941373b30b12d14b837ff53793fdf49fd70f524c9f6391285d62cf4a7c06
SSDEEP 3072:0Rz5n9Sae432oSLsMT3myjTvoTboVEBZP5pHQpYR95WPNp1wH:0T64a74LZPPHQpY35WPNpW
TLSH
T1C6348D21B5C1C5F1F97945356826C9910E6AFC369F500EAF3298332F0E761E2453BEAE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

12890

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\ACER\source\repos\salinewin-safety\Release\salinewin-safety.pdb

kernel32

GetConsoleCP GetConsoleMode HeapReAlloc SetFilePointerEx WriteConsoleW DecodePointer CreateFileW CreateThread CloseHandle TerminateThread FlushFileBuffers Sleep HeapSize GetProcessHeap GetStringTypeW GetFileType SetStdHandle QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW GetCurrentProcess TerminateProcess RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetACP HeapFree HeapAlloc FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA CompareStringW LCMapStringW RaiseException

user32

GetCursorPos ReleaseDC InvalidateRect GetDesktopWindow LoadIconW GetDC GetSystemMetrics DrawIcon

gdi32

SelectObject CreateDIBSection CreateCompatibleDC PolyBezier DeleteDC CreatePen Ellipse DeleteObject CreateSolidBrush BitBlt

winmm

waveOutOpen waveOutClose waveOutUnprepareHeader waveOutWrite waveOutPrepareHeader

Sharing