Slate[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Slate.exe
Size 4.9MB
Sample261108-zfqa5afv41
SHA256 202d90e44a992b6cce6e6e1873040bf89cb1ad73217cec091812439dc8454d42
MD5 5a2ed5644f5bb62b035c4c83960736f1
SHA1 1cdf41ee1a0a285feda547a60492a10c53c757b0
SHA512 1a5e92a36eac97edbd280abf0f8e52bfd8289e6e2aa6429d971a5d9af0d7010d82393cadd3ddfa2f889b5c7b175fce8c88fc4c0584212086c6df55f4dedad05a
SSDEEP 98304:8qiWQYUwpGdmInA2YUiEConbw7KUpko1:l8YE/nA2tiECEs7KU
TLSH
T16536D147B39A5FAAC03254384F01E127AEE2B8005779A3DBF2E29E1955172F01E7CB57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Slate.exe

File Explorer

Slate.exe

.exe 4.9MB

Slate.exe

IMPHASH f1b5359ee539ab094d07bb62b3d1e85d
SHA256 202d90e44a992b6cce6e6e1873040bf89cb1ad73217cec091812439dc8454d42
MD5 5a2ed5644f5bb62b035c4c83960736f1
SHA1 1cdf41ee1a0a285feda547a60492a10c53c757b0
SHA512 1a5e92a36eac97edbd280abf0f8e52bfd8289e6e2aa6429d971a5d9af0d7010d82393cadd3ddfa2f889b5c7b175fce8c88fc4c0584212086c6df55f4dedad05a
SSDEEP 98304:8qiWQYUwpGdmInA2YUiEConbw7KUpko1:l8YE/nA2tiECEs7KU
TLSH
T16536D147B39A5FAAC03254384F01E127AEE2B8005779A3DBF2E29E1955172F01E7CB57
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5099008

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

ole32

CoCreateInstance CoInitializeEx

dwmapi

DwmExtendFrameIntoClientArea

msvcp140

?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??7ios_base@std@@QEBA_NXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Thrd_detach _Mtx_lock _Mtx_unlock _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_function_call@std@@YAXXZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z

wininet

HttpOpenRequestA InternetConnectA InternetCloseHandle HttpSendRequestA InternetReadFile InternetSetOptionA InternetCrackUrlA InternetOpenA HttpQueryInfoA

comdlg32

GetOpenFileNameW

d3dcompiler_47

D3DCompile

user32

CloseClipboard SetClipboardData GetClipboardData EmptyClipboard TranslateMessage DispatchMessageA PeekMessageA DefWindowProcA PostQuitMessage UnregisterClassW RegisterClassExW CreateWindowExW DestroyWindow ShowWindow SetLayeredWindowAttributes SetWindowPos GetSystemMetrics UpdateWindow GetWindowLongPtrW OpenClipboard MessageBoxA GetAsyncKeyState SystemParametersInfoW LoadCursorA ScreenToClient ClientToScreen GetCursorPos SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout SetWindowLongPtrW SetCursor

kernel32

GlobalFree GlobalLock GlobalUnlock GlobalAlloc GetEnvironmentVariableW MultiByteToWideChar LoadLibraryA GetProcAddress GetModuleHandleA FreeLibrary QueryPerformanceFrequency QueryPerformanceCounter ReleaseSRWLockExclusive GetModuleFileNameA InitializeSListHead GetActiveProcessorCount GetCurrentProcess GetTickCount64 WideCharToMultiByte GetLocaleInfoA GetProcessTimes AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime GetNativeSystemInfo

shell32

ShellExecuteW

imm32

ImmSetCompositionWindow ImmGetContext ImmReleaseContext ImmSetCandidateWindow

vcruntime140

__std_terminate __intrinsic_setjmp __current_exception_context __current_exception __C_specific_handler longjmp strrchr __std_type_info_compare memchr strstr strchr memcmp _CxxThrowException memset memmove memcpy __std_exception_destroy __std_exception_copy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

__setusermatherr _dtest cosf sinf fabs fmodf powf _fdtest pow acosf ceilf sqrtf

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc free _callnewh

api-ms-win-crt-runtime-l1-1-0

_get_narrow_winmain_command_line _cexit system _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv terminate _initterm _errno _register_thread_local_exe_atexit_callback _c_exit _set_app_type _exit exit _initterm_e _wassert _beginthreadex _seh_filter_exe

api-ms-win-crt-convert-l1-1-0

strtoull strtol strtoll strtod

api-ms-win-crt-stdio-l1-1-0

setvbuf ungetc fgetpos fgetc _set_fmode _fseeki64 fsetpos __stdio_common_vfprintf fopen __stdio_common_vsprintf fwrite ftell fseek fread fflush fclose _wfopen __acrt_iob_func __p__commode __stdio_common_vsscanf fputc _get_stream_buffer_pointers

api-ms-win-crt-string-l1-1-0

strncpy wcslen strncmp strcmp tolower strlen

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file