slinky (4).exePE analysis report - Suspicious

Run integrity

sample ran

The guest staged the sample and launched it, so what follows describes this file rather than an empty desktop.

46.8sto launch

243telemetry events

72observed

60agent notes

Suspicious

35/100

0 points past the suspicious line at 35, 35 short of malicious at 70.

Clean0-34 Suspicious35-69 Malicious70-100

Why this verdict

+18

Review confirms

3 of 3 local reviews independently read this as suspicious, on top of 17 points the platform measured itself

+13

Static analysis

1 suspicious signature match(es)
1 high-risk capability bucket(s): Ransomware behaviour

Runtime behavior

1 Sigma rule match(es): Uncommon Child Process Of Conhost.EXE

Model review

findings review (advisory, not scored): suspicious - recursive self-spawning, process tree flooding, conhost child processes, wmi antianalysis queries

Model reading

Measured SUSPICIOUS35 of 100

Evidence ledger above, row by row. Published verdict rests on this column and on nothing to its right.

Model reads it asadvisory, no points NOT ASSESSEDnot shown on this page

Reads this report's derived findings, never the sample itself.

A model reading exists for this scan and is shown to the submitter and to staff only. It is a second opinion about evidence the score already priced, it is worth no points, and on a public page it would stand beside the verdict with no grounding a stranger could check.

Analysis layers

Static ran moved the score

Dynamic ran moved the score

Threat intel local feeds only no points

AI not included

Sample

TypeFile

MIMEapplication/vnd.microsoft.portable-executable

Run conditions

Sandbox OSWindows 10

EnvironmentWorkgroup

InternetIsolated

Execution146s (ended early)

Guest hardware2 vCPU4095 MB RAM

Detection signatures

14 detected · 9 withheld as common

Severity	Detection	Evidence	Layer
MED	Decrypts data at runtime (CryptDecrypt) MITRE T1140	import advapi32.dll!CryptDecrypt	static
MED	High file entropy (encrypted/compressed payload) MITRE T1027	entropy 7.94 threshold 7.20, maximum 8.00	static
MED	Ransomware-related strings MITRE T1486	string decrypt matched string	static
MED	Raw socket networking MITRE T1095	import ws2_32.dll!WSAStartup	static
MED	TLS callback (pre-main execution) MITRE T1055	pe_header IMAGE_DIRECTORY_ENTRY_TLS present callbacks run before the entry point	static
LOW	Cryptographic capability (packing/ransom) MITRE T1573 seen in 6% of benign software	capability cryptacquirecontextw capability: crypto capability cryptdecrypt capability: crypto capability crypthashdata capability: crypto	static
LOW	Deletes files/backups (WriteFile + DeleteFile recursion) MITRE T1485 seen in 14% of benign software	import kernel32.dll!DeleteFileW requires deletefile import kernel32.dll!FindNextFileW requires findnextfile	static
LOW	Enumerates top-level windows (analysis-tool / target recon) MITRE T1010	import user32.dll!EnumWindows	static
LOW	Executes via ShellExecute MITRE T1204 seen in 12% of benign software	import shell32.dll!ShellExecuteExW	static
LOW	Hides its window (ShowWindow SW_HIDE pattern) MITRE T1564.003 seen in 13% of benign software	import user32.dll!ShowWindow	static
LOW	Marks files hidden/system (SetFileAttributes) MITRE T1564.001 seen in 10% of benign software	import kernel32.dll!SetFileAttributesW	static
LOW	Network communication capability MITRE T1071 seen in 6% of benign software	capability bind capability: network capability connect capability: network capability gethostbyname capability: network capability recv capability: network capability send capability: network capability socket capability: network	static
LOW	Self-deletion pattern (MoveFileEx) MITRE T1070.004 seen in 7% of benign software	import kernel32.dll!MoveFileExW	static
LOW	Spawns child processes MITRE T1106 seen in 16% of benign software	import kernel32.dll!CreateProcessW	static

Withheld: 9 rules fired and were not reported above

These rules matched this sample, and they also match this much of known-clean software (measured over 1145 signed Windows and third-party binaries). A rule that fires on most clean files cannot move a verdict, so it is held back unless the detonation confirms the behaviour. They are listed because a count that shrinks without saying so is not a count an analyst can check.

Timing-based anti-analysis (QueryPerformanceCounter/rdtsc) fires on 92% of benign software

Anti-debugging capability fires on 65% of benign software

Dynamic API resolution (obfuscation) fires on 65% of benign software

Anti-debug: checks for a debugger fires on 60% of benign software

Resolves APIs dynamically (LoadLibrary + GetProcAddress) fires on 49% of benign software

Creates a named mutex (single-instance / infection marker) fires on 31% of benign software

Executes external code / commands fires on 30% of benign software

Queries system information (host recon) fires on 25% of benign software

Enumerates files recursively (staging/collection) fires on 21% of benign software

What the tests returned

7 tests

Each test this run performed and what it returned. A test that was not performed says so rather than reading as a negative result.

Test	Result
Persistence mechanisms	not tested - the autostart surfaces were snapshotted before the sample ran, but this run left no record of the comparison afterwards, so an empty result cannot be read as a clean one
Cross-process injection	none observed
Payloads written to disk	none observed
Network connections	not tested - this run had no route out, so an empty network section is a property of the run and not an observation about the sample
Known-malicious hash (reputation sources)	no source reported this file
Local anti-virus engine	reported no detection
Capability analysis of the file's code	not checked - the check ran past its time limit and was stopped

Absence of an observation is not proof of absence - see Coverage for what this run could and could not test.

Arguing against malice

The local anti-virus engine reported no detection.
No reputation source reported this file as malicious.

How much weight this carries

Observed. Observed at runtime and attributed to this sample by one layer. The one fact that decided it: behavioural rule matched.

Instrument coverage

0 of 2 measured

What this run was able to observe, as the run itself recorded it. A layer that did not run makes an empty result a fact about the sandbox rather than about the sample.

Layer	Ran	What that means
Runtime anti-analysis watch	not measured	Not measured. No in-process monitor reported in on this run, so the runtime anti-debug and anti-VM calls were never watched and an empty list is not a finding about the sample.
Network capture	not on this plan	Not included on this scan's plan.
Live kernel introspection	not measured	Not measured. This run did not ask for the memory-dump option, which is what starts the introspection loop.

This lists the layers this run recorded for itself. A layer that is not listed was not recorded either way, so its absence here is not a result.

Structure

What the file is made of: headers, imports, how it was built and whether it was signed.

Signature

Microsoft Visual C/C++(19.36.35229)[C++]

Not packed Unsigned

CompilerMicrosoft Visual C/C++(19.36.35229)[C++]

LinkerMicrosoft Linker(14.36.35229)

LibraryMicrosoft C/C++ Runtime[dynamic]

Identity

File

typeexecutable

size47.4 MB

file arch64-bit (x64)

subsystemConsole

entropy7.9352

date2026-10-10 18:37:27 UTC

languageEN

Antivirus engine

no signature matched signature set 28151 - 3.6M signatures

Nothing in the signature set below matched this file. That is one engine's negative answer against one signature set on one day, and it is not a verdict. A signature engine only recognises what has already been named and published, so a file nobody has named yet scans exactly like a file that is harmless. What this file does when it runs is the stronger evidence; read the behaviour sections for that.

Signature set	Value
Set version	28151
Signatures in the set	3,642,867
Set published	12 Oct 2026 06:24 +0000
Age when this file was scanned	same day

A negative answer is only as good as the signature set that gave it, so the set is recorded with the result and the result can be reproduced against it.

Local ML assessment

no model score

No model score exists for this file: the file is larger than the 32 MB the local model is allowed to read in one scan, so it got a static heuristic instead. That is a gap in coverage and not a finding - the absence of a score here says nothing about the file.

Structural rules of thumb, not a model. 3 cheap static signals fired, for 45 of 100 on a rule-of-thumb scale that is deliberately left out of the verdict score: the packing, entropy and signing cards on this report already price the same facts, and counting them a second time under a machine-learning heading would charge one piece of evidence twice.

high entropy 7.9352
unsigned executable
TLS callback

Packing

Not packed

This file's code is readable on disk - nothing is compressed or encrypted around it.

24/100

packer confidence

Static analysis reads this file directly Nothing is hiding the code from a static pass, so what the file contains is what the report shows.

Indicators weighed 4 signals

Executable-section entropy 6.71 (elevated)
High-entropy resource (possible packed payload)
High-entropy resource (possible packed payload)
TLS callback present

Family configuration search

Not attempted

The sample is 47.4 MB and the config parser pass is bounded at 16.0 MB, so no family parser was run against it - a family configuration may exist in this file and was not looked for. The absence of an extracted configuration is therefore not evidence about this sample.

Sample size	47.4 MB
Bound	16.0 MB
Limit reached	Sample size, before any parser was loaded.

Secrets & malicious strings

1 flagged string

Flagged string categories

ransomware med 1 hit

Indicator	Found in	Evidence from the sample
decrypt	import table	ADVAPI32.dll!CryptDecrypt

Capabilities

8 behaviour buckets · 2 high-risk

Severity	Capability	MITRE	APIs
high	Ransomware behaviour Enumerates + encrypts files, deletes backups	T1083	findfirstfilew, findnextfilew
high	Anti-debugging Detects or obstructs a debugger	T1622	isdebuggerpresent
med	Network / C2 Opens sockets, HTTP or downloads payloads	T1071, T1095, T1590	bind, connect, gethostbyname, recv, send, socket, wsastartup
med	Cryptography Uses crypto APIs (often ransomware / packers)	T1486, T1573	cryptacquirecontextw, cryptdecrypt, crypthashdata
med	Dynamic API resolution Resolves APIs at runtime (obfuscation)	T1129	getprocaddress, loadlibrarya, loadlibraryw
med	Evasion / stalling Sleeps, times, or otherwise stalls analysis	T1497, T1497.003	getsystemtimeasfiletime, queryperformancecounter, sleep
med	Code execution Creates processes / runs commands or shellcode	T1106, T1203	createprocessw, shellexecuteexw, shellexecutew
low	Discovery Enumerates the host, users, processes or network	T1082	getsysteminfo

Security mitigations

partial posture

ON ASLR (DynamicBase)

ON High-entropy ASLR (64-bit)

ON DEP / NX (NxCompat)

OFF Control Flow Guard

OFF SafeSEH

ON Stack cookies (GS)

OFF Force Integrity

OFF AppContainer isolation

OFF Authenticode signed

Rich header (toolchain)

richhash 914b4232cba33622

Tool	Build	Uses
prodid_147	30729	22
Utc1900 (VS2017)	35207	4
Cvtres 14.10	35207	10
Export 14.10	35207	36
Utc1900 (VS2017)	35207	6
Import (linker)	0	457
Utc1900 (VS2017)	33145	19
Unknown	0	42
Cvtres 14.10	35229	975
Export 14.10	35229	19
Implib	35229	1
prodid_151	0	1
AliasObj 14.10	35229	1

Sections

6 sections · the file's memory layout

Section	Virtual addr	Raw size	Virtual size	Access	Entropy
.textEP Executable code	0x1000	3.9 MB	3.9 MB	EXECUTEREAD	6.711
.rdata Read-only data	0x3f1000	1.4 MB	1.4 MB	READ	5.8854
.data Initialised data	0x553000	422.0 KB	954.5 KB expands	READWRITE	0.4594
.pdata Exception unwind data	0x642000	151.5 KB	151.1 KB	READ	6.309
.rsrc Resources	0x668000	41.5 MB	41.5 MB	READ	8.0
.reloc Base relocations	0x2fe3000	53.5 KB	53.5 KB	READ	5.4353

code data imports/exports resources metadata packer non-standard Entropy above 7.0 means compressed or encrypted content.

Imports

423 funcs / 23 DLLs · 17 suspicious

▸WS2_32.dll34 funcs 4 suspicious

Name	File RVA	Is undocumented	MITRE (tactic - technique)
WSACleanup	0x003f1908	-	-
WSAStartup	0x003f1910	-	T1071
setsockopt	0x003f1918	-	-
htons	0x003f1920	-	-
htonl	0x003f1928	-	-
connect	0x003f1930	-	T1071
socket	0x003f1938	-	T1071
__WSAFDIsSet	0x003f1940	-	-
accept	0x003f1948	-	-
bind	0x003f1950	-	-
getpeername	0x003f1958	-	-
listen	0x003f1960	-	-
ntohs	0x003f1968	-	-
recv	0x003f1970	-	-
select	0x003f1978	-	-
send	0x003f1980	-	T1071
inet_ntop	0x003f1988	-	-
WSAGetLastError	0x003f1990	-	-
WSAIoctl	0x003f1998	-	-
getsockname	0x003f19a0	-	-
WSASocketA	0x003f19a8	-	-
WSASetLastError	0x003f19b0	-	-
getsockopt	0x003f19b8	-	-
recvfrom	0x003f19c0	-	-
sendto	0x003f19c8	-	-
inet_addr	0x003f19d0	-	-
inet_ntoa	0x003f19d8	-	-
gethostbyaddr	0x003f19e0	-	-
gethostbyname	0x003f19e8	-	-
getservbyport	0x003f19f0	-	-
getservbyname	0x003f19f8	-	-
ioctlsocket	0x003f1a00	-	-
shutdown	0x003f1a08	-	-
closesocket	0x003f1a10	-	-

▸CRYPT32.dll12 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
CertDuplicateCertificateContext	0x003f10b8	-	-
CertEnumCertificatesInStore	0x003f10c0	-	-
CertCreateCertificateContext	0x003f10c8	-	-
CertCloseStore	0x003f10d0	-	-
CertOpenStore	0x003f10d8	-	-
CertOpenSystemStoreW	0x003f10e0	-	-
CertGetCertificateContextProperty	0x003f10e8	-	-
CertFindCertificateInStore	0x003f10f0	-	-
CryptStringToBinaryA	0x003f10f8	-	-
CertDeleteCertificateFromStore	0x003f1100	-	-
CertAddCertificateContextToStore	0x003f1108	-	-
CertFreeCertificateContext	0x003f1110	-	-

▸bcrypt.dll6 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
BCryptCreateHash	0x003f1db8	-	-
BCryptHashData	0x003f1dc0	-	-
BCryptFinishHash	0x003f1dc8	-	-
BCryptDestroyHash	0x003f1dd0	-	-
BCryptCloseAlgorithmProvider	0x003f1dd8	-	-
BCryptOpenAlgorithmProvider	0x003f1de0	-	-

▸ADVAPI32.dll22 funcs 2 suspicious

Name	File RVA	Is undocumented	MITRE (tactic - technique)
CryptGetHashParam	0x003f1000	-	-
CheckTokenMembership	0x003f1008	-	-
FreeSid	0x003f1010	-	-
CryptAcquireContextW	0x003f1018	-	T1486
CryptEnumProvidersW	0x003f1020	-	-
CryptSignHashW	0x003f1028	-	-
CryptDecrypt	0x003f1030	-	T1486
CryptExportKey	0x003f1038	-	-
CryptGetUserKey	0x003f1040	-	-
CryptGetProvParam	0x003f1048	-	-
CryptSetHashParam	0x003f1050	-	-
CryptDestroyKey	0x003f1058	-	-
CryptGenRandom	0x003f1060	-	-
ReportEventW	0x003f1068	-	-
RegisterEventSourceW	0x003f1070	-	-
DeregisterEventSource	0x003f1078	-	-
SystemFunction036	0x003f1080	-	-
CryptDestroyHash	0x003f1088	-	-
CryptHashData	0x003f1090	-	-
CryptCreateHash	0x003f1098	-	-
CryptReleaseContext	0x003f10a0	-	-
AllocateAndInitializeSid	0x003f10a8	-	-

▸SHELL32.dll3 funcs 1 suspicious

Name	File RVA	Is undocumented	MITRE (tactic - technique)
CommandLineToArgvW	0x003f17c8	-	-
ShellExecuteW	0x003f17d0	-	T1106
ShellExecuteExW	0x003f17d8	-	-

▸USER32.dll12 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
MessageBoxW	0x003f17e8	-	-
GetUserObjectInformationW	0x003f17f0	-	-
GetProcessWindowStation	0x003f17f8	-	-
GetWindow	0x003f1800	-	-
GetWindowThreadProcessId	0x003f1808	-	-
EnumWindows	0x003f1810	-	-
GetWindowLongPtrW	0x003f1818	-	-
GetWindowTextLengthW	0x003f1820	-	-
GetWindowTextW	0x003f1828	-	-
IsWindowVisible	0x003f1830	-	-
SendMessageTimeoutW	0x003f1838	-	-
ShowWindow	0x003f1840	-	-

▸VERSION.dll3 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
GetFileVersionInfoW	0x003f18e8	-	-
VerQueryValueW	0x003f18f0	-	-
GetFileVersionInfoSizeW	0x003f18f8	-	-

▸Cabinet.dll3 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
ordinal_40	0x003f1120	yes	-
ordinal_43	0x003f1128	yes	-
ordinal_45	0x003f1130	yes	-

▸KERNEL32.dll110 funcs 10 suspicious

Name	File RVA	Is undocumented	MITRE (tactic - technique)
ReadConsoleW	0x003f1140	-	-
GetLocaleInfoEx	0x003f1148	-	-
CreateDirectoryW	0x003f1150	-	-
FindFirstFileExW	0x003f1158	-	-
GetFileAttributesExW	0x003f1160	-	-
ReadConsoleA	0x003f1168	-	-
GetSystemTimeAsFileTime	0x003f1170	-	-
ConvertThreadToFiberEx	0x003f1178	-	-
RtlVirtualUnwind	0x003f1180	yes	-
WriteFile	0x003f1188	-	-
GetACP	0x003f1190	-	-
AreFileApisANSI	0x003f1198	-	-
GetFileInformationByHandleEx	0x003f11a0	-	-
SleepConditionVariableSRW	0x003f11a8	-	-
WakeAllConditionVariable	0x003f11b0	-	-
RtlCaptureContext	0x003f11b8	yes	-
RtlLookupFunctionEntry	0x003f11c0	yes	-
UnhandledExceptionFilter	0x003f11c8	-	-
SetUnhandledExceptionFilter	0x003f11d0	-	-
TerminateProcess	0x003f11d8	-	-
IsProcessorFeaturePresent	0x003f11e0	-	-
CreateSemaphoreA	0x003f11e8	-	-
ReleaseSemaphore	0x003f11f0	-	-
DeleteCriticalSection	0x003f11f8	-	-
FormatMessageA	0x003f1200	-	-
LoadLibraryA	0x003f1208	-	T1129
FreeLibrary	0x003f1210	-	-
GetSystemDirectoryA	0x003f1218	-	-
FindNextFileW	0x003f1220	-	T1083
FindFirstFileW	0x003f1228	-	T1083
FindClose	0x003f1230	-	-
SystemTimeToFileTime	0x003f1238	-	-
GetSystemTime	0x003f1240	-	-
GetModuleHandleExW	0x003f1248	-	-
GetFileType	0x003f1250	-	-
CreateFiberEx	0x003f1258	-	-
DeleteFiber	0x003f1260	-	-
SwitchToFiber	0x003f1268	-	-
TlsFree	0x003f1270	-	-
TlsSetValue	0x003f1278	-	-
TlsGetValue	0x003f1280	-	-
IsDebuggerPresent	0x003f1288	-	T1622
InitializeSListHead	0x003f1290	-	-
ConvertFiberToThread	0x003f1298	-	-
GetEnvironmentVariableW	0x003f12a0	-	-
DeleteFileW	0x003f12a8	-	-
CloseHandle	0x003f12b0	-	-
GetLastError	0x003f12b8	-	-
ReleaseMutex	0x003f12c0	-	-
WaitForSingleObject	0x003f12c8	-	-
CreateMutexW	0x003f12d0	-	T1027
GetCurrentProcessId	0x003f12d8	-	-
GetModuleHandleW	0x003f12e0	-	-
LoadResource	0x003f12e8	-	T1129
LockResource	0x003f12f0	-	-
SizeofResource	0x003f12f8	-	-
FindResourceW	0x003f1300	-	-
MoveFileExW	0x003f1308	-	-
MultiByteToWideChar	0x003f1310	-	-
QueryPerformanceCounter	0x003f1318	-	T1497
GetCurrentProcess	0x003f1320	-	-
GetCurrentThread	0x003f1328	-	-
GetCommandLineW	0x003f1330	-	-
GetModuleFileNameW	0x003f1338	-	-
LocalFree	0x003f1340	-	-
WideCharToMultiByte	0x003f1348	-	-
SetConsoleOutputCP	0x003f1350	-	-
SetConsoleTitleW	0x003f1358	-	-
GetConsoleWindow	0x003f1360	-	-
GetStdHandle	0x003f1368	-	-
GetLocalTime	0x003f1370	-	-
GetConsoleMode	0x003f1378	-	-
SetConsoleMode	0x003f1380	-	-
Sleep	0x003f1388	-	-
GetConsoleCursorInfo	0x003f1390	-	-
SetConsoleCursorInfo	0x003f1398	-	-
GetConsoleScreenBufferInfo	0x003f13a0	-	-
GetConsoleScreenBufferInfoEx	0x003f13a8	-	-
SetConsoleScreenBufferInfoEx	0x003f13b0	-	-
SetConsoleScreenBufferSize	0x003f13b8	-	-
SetConsoleCursorPosition	0x003f13c0	-	-
WriteConsoleOutputA	0x003f13c8	-	-
GetProcAddress	0x003f13d0	-	T1129
CreateFileW	0x003f13d8	-	-
GetFileAttributesW	0x003f13e0	-	-
SetFileAttributesW	0x003f13e8	-	-
GetWindowsDirectoryW	0x003f13f0	-	-
LoadLibraryW	0x003f13f8	-	T1129
QueryFullProcessImageNameW	0x003f1400	-	-
ReadFile	0x003f1408	-	-
CreatePipe	0x003f1410	-	-
GetExitCodeProcess	0x003f1418	-	-
CreateProcessW	0x003f1420	-	T1106
GetProcessTimes	0x003f1428	-	-
GetExitCodeThread	0x003f1430	-	-
VirtualFreeEx	0x003f1438	-	-
OpenThread	0x003f1440	-	-
InitializeCriticalSection	0x003f1448	-	-
EnterCriticalSection	0x003f1450	-	-
LeaveCriticalSection	0x003f1458	-	-
GetSystemInfo	0x003f1460	-	-
VirtualFree	0x003f1468	-	-
SetLastError	0x003f1470	-	-
InitializeSRWLock	0x003f1478	-	-
ReleaseSRWLockExclusive	0x003f1480	-	-
ReleaseSRWLockShared	0x003f1488	-	-
AcquireSRWLockExclusive	0x003f1490	-	-
AcquireSRWLockShared	0x003f1498	-	-
GetCurrentThreadId	0x003f14a0	-	-
TlsAlloc	0x003f14a8	-	-

▸MSVCP140.dll97 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z	0x003f14b8	-	-
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ	0x003f14c0	-	-
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z	0x003f14c8	-	-
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z	0x003f14d0	-	-
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ	0x003f14d8	-	-
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ	0x003f14e0	-	-
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z	0x003f14e8	-	-
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ	0x003f14f0	-	-
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z	0x003f14f8	-	-
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z	0x003f1500	-	-
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z	0x003f1508	-	-
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ	0x003f1510	-	-
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ	0x003f1518	-	-
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z	0x003f1520	-	-
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z	0x003f1528	-	-
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ	0x003f1530	-	-
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z	0x003f1538	-	-
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ	0x003f1540	-	-
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ	0x003f1548	-	-
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ	0x003f1550	-	-
?id@?$ctype@D@std@@2V0locale@2@A	0x003f1558	-	-
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z	0x003f1560	-	-
?gcount@?$basic_istream@DU?$char_traits@D@std@@@std@@QEBA_JXZ	0x003f1568	-	-
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z	0x003f1570	-	-
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z	0x003f1578	-	-
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ	0x003f1580	-	-
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z	0x003f1588	-	-
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z	0x003f1590	-	-
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z	0x003f1598	-	-
??0_Lockit@std@@QEAA@H@Z	0x003f15a0	-	-
??1_Lockit@std@@QEAA@XZ	0x003f15a8	-	-
?_Xbad_alloc@std@@YAXXZ	0x003f15b0	-	-
?_Xlength_error@std@@YAXPEBD@Z	0x003f15b8	-	-
?_Xout_of_range@std@@YAXPEBD@Z	0x003f15c0	-	-
_Mtx_lock	0x003f15c8	-	-
_Mtx_unlock	0x003f15d0	-	-
?_Throw_Cpp_error@std@@YAXH@Z	0x003f15d8	-	-
?_Syserror_map@std@@YAPEBDH@Z	0x003f15e0	-	-
?_Winerror_map@std@@YAHH@Z	0x003f15e8	-	-
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ	0x003f15f0	-	-
?always_noconv@codecvt_base@std@@QEBA_NXZ	0x003f15f8	-	-
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z	0x003f1600	-	-
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z	0x003f1608	-	-
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z	0x003f1610	-	-
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z	0x003f1618	-	-
??7ios_base@std@@QEBA_NXZ	0x003f1620	-	-
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ	0x003f1628	-	-
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ	0x003f1630	-	-
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ	0x003f1638	-	-
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ	0x003f1640	-	-
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ	0x003f1648	-	-
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ	0x003f1650	-	-
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ	0x003f1658	-	-
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z	0x003f1660	-	-
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z	0x003f1668	-	-
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ	0x003f1670	-	-
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ	0x003f1678	-	-
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ	0x003f1680	-	-
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ	0x003f1688	-	-
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z	0x003f1690	-	-
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ	0x003f1698	-	-
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ	0x003f16a0	-	-
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ	0x003f16a8	-	-
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z	0x003f16b0	-	-
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z	0x003f16b8	-	-
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z	0x003f16c0	-	-
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ	0x003f16c8	-	-
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z	0x003f16d0	-	-
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ	0x003f16d8	-	-
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z	0x003f16e0	-	-
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ	0x003f16e8	-	-
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z	0x003f16f0	-	-
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z	0x003f16f8	-	-
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ	0x003f1700	-	-
?_Id_cnt@id@locale@std@@0HA	0x003f1708	-	-
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A	0x003f1710	-	-
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ	0x003f1718	-	-
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ	0x003f1720	-	-
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ	0x003f1728	-	-
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z	0x003f1730	-	-
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ	0x003f1738	-	-
_Query_perf_counter	0x003f1740	-	-
_Query_perf_frequency	0x003f1748	-	-
_Thrd_join	0x003f1750	-	-
_Thrd_id	0x003f1758	-	-
_Cnd_do_broadcast_at_thread_exit	0x003f1760	-	-
?uncaught_exceptions@std@@YAHXZ	0x003f1768	-	-
?_Xinvalid_argument@std@@YAXPEBD@Z	0x003f1770	-	-
_Thrd_detach	0x003f1778	-	-
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z	0x003f1780	-	-
??Bios_base@std@@QEBA_NXZ	0x003f1788	-	-
?good@ios_base@std@@QEBA_NXZ	0x003f1790	-	-
?flags@ios_base@std@@QEBAHXZ	0x003f1798	-	-
?width@ios_base@std@@QEBA_JXZ	0x003f17a0	-	-
?width@ios_base@std@@QEAA_J_J@Z	0x003f17a8	-	-
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ	0x003f17b0	-	-
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ	0x003f17b8	-	-

▸VCRUNTIME140.dll16 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
strstr	0x003f1850	-	-
memchr	0x003f1858	-	-
__std_terminate	0x003f1860	-	-
memcmp	0x003f1868	-	-
__C_specific_handler	0x003f1870	-	-
__current_exception_context	0x003f1878	-	-
memset	0x003f1880	-	-
__current_exception	0x003f1888	-	-
wcsstr	0x003f1890	-	-
strrchr	0x003f1898	-	-
strchr	0x003f18a0	-	-
__std_exception_copy	0x003f18a8	-	-
__std_exception_destroy	0x003f18b0	-	-
_CxxThrowException	0x003f18b8	-	-
memmove	0x003f18c0	-	-
memcpy	0x003f18c8	-	-

▸VCRUNTIME140_1.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
__CxxFrameHandler4	0x003f18d8	-	-

▸api-ms-win-crt-runtime-l1-1-0.dll25 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
__p___wargv	0x003f1ae8	-	-
terminate	0x003f1af0	-	-
__p___argc	0x003f1af8	-	-
exit	0x003f1b00	-	-
_initterm_e	0x003f1b08	-	-
_initterm	0x003f1b10	-	-
_register_thread_local_exe_atexit_callback	0x003f1b18	-	-
_initialize_wide_environment	0x003f1b20	-	-
_configure_wide_argv	0x003f1b28	-	-
strerror_s	0x003f1b30	-	-
_set_app_type	0x003f1b38	-	-
_seh_filter_exe	0x003f1b40	-	-
_cexit	0x003f1b48	-	-
_register_onexit_function	0x003f1b50	-	-
_initialize_onexit_table	0x003f1b58	-	-
_exit	0x003f1b60	-	-
raise	0x003f1b68	-	-
_invoke_watson	0x003f1b70	-	-
_errno	0x003f1b78	-	-
_c_exit	0x003f1b80	-	-
_get_initial_wide_environment	0x003f1b88	-	-
_crt_atexit	0x003f1b90	-	-
_beginthreadex	0x003f1b98	-	-
signal	0x003f1ba0	-	-
abort	0x003f1ba8	-	-

▸api-ms-win-crt-stdio-l1-1-0.dll38 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
__stdio_common_vsprintf	0x003f1bb8	-	-
fopen	0x003f1bc0	-	-
_wfopen	0x003f1bc8	-	-
__stdio_common_vswprintf	0x003f1bd0	-	-
__stdio_common_vsnwprintf_s	0x003f1bd8	-	-
_write	0x003f1be0	-	-
_read	0x003f1be8	-	-
_wfopen_s	0x003f1bf0	-	-
_lseek	0x003f1bf8	-	-
_close	0x003f1c00	-	-
__stdio_common_vsprintf_s	0x003f1c08	-	-
_get_stream_buffer_pointers	0x003f1c10	-	-
ungetc	0x003f1c18	-	-
setvbuf	0x003f1c20	-	-
fwrite	0x003f1c28	-	-
_fseeki64	0x003f1c30	-	-
_setmode	0x003f1c38	-	-
_get_osfhandle	0x003f1c40	-	-
ftell	0x003f1c48	-	-
_set_fmode	0x003f1c50	-	-
fseek	0x003f1c58	-	-
fgets	0x003f1c60	-	-
ferror	0x003f1c68	-	-
feof	0x003f1c70	-	-
fclose	0x003f1c78	-	-
fsetpos	0x003f1c80	-	-
__p__commode	0x003f1c88	-	-
__acrt_iob_func	0x003f1c90	-	-
fputs	0x003f1c98	-	-
fread	0x003f1ca0	-	-
fputc	0x003f1ca8	-	-
fflush	0x003f1cb0	-	-
fgetpos	0x003f1cb8	-	-
__stdio_common_vsnprintf_s	0x003f1cc0	-	-
__stdio_common_vfprintf	0x003f1cc8	-	-
fgetc	0x003f1cd0	-	-
__stdio_common_vsscanf	0x003f1cd8	-	-
_fileno	0x003f1ce0	-	-

▸api-ms-win-crt-filesystem-l1-1-0.dll3 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
_lock_file	0x003f1a60	-	-
_unlock_file	0x003f1a68	-	-
_stat64i32	0x003f1a70	-	-

▸api-ms-win-crt-heap-l1-1-0.dll6 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
malloc	0x003f1a80	-	-
_set_new_mode	0x003f1a88	-	-
_callnewh	0x003f1a90	-	-
calloc	0x003f1a98	-	-
free	0x003f1aa0	-	-
realloc	0x003f1aa8	-	-

▸api-ms-win-crt-string-l1-1-0.dll19 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
iswdigit	0x003f1cf0	-	-
tolower	0x003f1cf8	-	-
isdigit	0x003f1d00	-	-
towlower	0x003f1d08	-	-
wcscmp	0x003f1d10	-	-
strpbrk	0x003f1d18	-	-
wcslen	0x003f1d20	-	-
strlen	0x003f1d28	-	-
strncpy	0x003f1d30	-	-
strncpy_s	0x003f1d38	-	-
strcat_s	0x003f1d40	-	-
strcpy_s	0x003f1d48	-	-
strspn	0x003f1d50	-	-
strcspn	0x003f1d58	-	-
_wcsicmp	0x003f1d60	-	-
strcpy	0x003f1d68	-	-
strcmp	0x003f1d70	-	-
strncmp	0x003f1d78	-	-
isspace	0x003f1d80	-	-

▸api-ms-win-crt-math-l1-1-0.dll2 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
__setusermatherr	0x003f1ad0	-	-
log2	0x003f1ad8	-	-

▸api-ms-win-crt-convert-l1-1-0.dll5 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
strtoull	0x003f1a20	-	-
atoi	0x003f1a28	-	-
_wtoi	0x003f1a30	-	-
strtol	0x003f1a38	-	-
strtoul	0x003f1a40	-	-

▸api-ms-win-crt-time-l1-1-0.dll2 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
_gmtime64_s	0x003f1d90	-	-
_time64	0x003f1d98	-	-

▸api-ms-win-crt-utility-l1-1-0.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
qsort	0x003f1da8	-	-

▸api-ms-win-crt-environment-l1-1-0.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
getenv	0x003f1a50	-	-

▸api-ms-win-crt-locale-l1-1-0.dll2 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
_configthreadlocale	0x003f1ab8	-	-
___lc_codepage_func	0x003f1ac0	-	-

Binary metadata

what the headers declare about this build

Resource langs	EN
Debug info	yes
TLS callbacks	yes

Code signing

Unsigned

This binary carries no Authenticode signature. Unsigned executables are a weak suspicious signal - most legitimate vendor software is signed.

Resources

Resource Hacker view

Manifest1RCData8

▸Manifest1

1EN

▸RCData8

201EN

202EN

203EN

204EN

205EN

206EN

207EN

208EN

Select a resource from the tree to inspect its language, size, RVA offset, MD5, entropy and detected content signature - like opening the binary in Resource Hacker.

Manifest 1 Download

Type	Manifest
Name / ID	1
Language	EN
Size	468.0 B
RVA offset	0x2fe2bc0
Content signature	XML manifest
MD5	4552fb34de121a874c012f98e88d1419
Entropy	4.986

Application manifest

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <assemblyIdentity version="1.0.0.0" processorArchitecture="amd64" name="update5392c2" type="win32"/>
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
    <security><requestedPrivileges>
      <requestedExecutionLevel level="requireAdministrator" uiAccess="false"/>
    </requestedPrivileges></security>
  </trustInfo>
</assembly>

RCData 201 Download

Type	RCData
Name / ID	201
Language	EN
Size	22.4 MB
RVA offset	0x6681f0
Content signature	RCData
MD5	f6950fda9cae751177b7053aab449c01
Entropy	8.0

RCData 202 Download

Type	RCData
Name / ID	202
Language	EN
Size	19.1 MB
RVA offset	0x1ccd840
Content signature	RCData
MD5	5620fa8bb99a34e601415dfda2a733c5
Entropy	8.0

RCData 203 Download

Type	RCData
Name / ID	203
Language	EN
Size	952.0 B
RVA offset	0x2fe0f50
Content signature	RCData
MD5	7840e46d66d06b00b5a94b5f5ef7bbab
Entropy	7.783

RCData 204 Download

Type	RCData
Name / ID	204
Language	EN
Size	838.0 B
RVA offset	0x2fe1308
Content signature	RCData
MD5	11a254faefaa107896d2c24c5e9d50a5
Entropy	7.755

RCData 205 Download

Type	RCData
Name / ID	205
Language	EN
Size	932.0 B
RVA offset	0x2fe1650
Content signature	RCData
MD5	3f10e924076f6449fd4b16a400b57002
Entropy	7.793

RCData 206 Download

Type	RCData
Name / ID	206
Language	EN
Size	2.0 KB
RVA offset	0x2fe19f8
Content signature	RCData
MD5	46c198ac351f0a66a7c663deca0e7b9c
Entropy	7.895

RCData 207 Download

Type	RCData
Name / ID	207
Language	EN
Size	1.7 KB
RVA offset	0x2fe21e0
Content signature	RCData
MD5	09e1bebcd9126126831f58b149adaeaf
Entropy	7.891

RCData 208 Download

Type	RCData
Name / ID	208
Language	EN
Size	818.0 B
RVA offset	0x2fe2888
Content signature	RCData
MD5	e7ddc3af4a831d3fdd2b00692ddfd9dd
Entropy	7.753

Similar samples

1 related sample

Ranked by fuzzy hash (TLSH distance - lower is closer) and ssdeep similarity, plus an identical import table. A near-identical neighbour is usually the same build; a variant is the same family rebuilt or repacked.

Relation	Sample	Verdict	Why it matched
variant	meccha-camouflage-v1.7.2.exe	Malicious	TLSH distance 68

Capability detection

not completed

The capability analysis of this file's code did not finish, so what the file is able to do was not established from its instructions. This narrows what the run covered - read it alongside Coverage rather than as a finding about the file. Cause: the check ran past its time limit and was stopped.

Signature matches

1 finding · 5 file properties · 1 scored

Rule	What it matched	Corpus	Weight
Suspicious_Anti_Debug_API	Anti-debugging API names referenced 2 of 4 strings matched $a IsDebuggerPresent at 0x552122 $c NtQueryInformationProcess at 0x402038	Built-in ruleset this platform ships, and the only one the score reads	SCORED 5 Scored 5, sharing a 15 point cap with every other anti-vm, anti-debug, dropper or packer match.

File properties - not findings

IsPE64IsConsoleIsPackedHasDebugDataHasRichSignature

These say what the file IS or holds - bitness, subsystem, an overlay, an embedded macro stream, which compiler built it. Ordinary files match several, and none of them carry weight in the score.

Extracted strings

showing 169

!This program cannot be run in DOS mode.
Rich
.text
`.rdata
@.data
.pdata
@.rsrc
@.reloc
Genu
ineI
ntel
Auth
enti
cAMD
USATAUAVAWH
ot$pfD
ot$pfA
ot$pfE
A@tkf
$SUATAUAVH
SATAUI
rc4(8x,int)
rc4(8x,char)
rc4(16x,int)
RC4 for x86_64, CRYPTOGAMS by <https://github.com/dot-asm>
Centu
aulsu<
anghu*
VIA Padlock x86_64 module, CRYPTOGAMS by <https://github.com/dot-asm>
Montgomery Multiplication for x86_64, CRYPTOGAMS by <https://github.com/dot-asm>
ATAUL
ATAUM1
USATAUAVAWL
USATAUAVAW
ATAUH
orPH
}o%toJ
onPH
USATAVAWH
SUATAUAVI
SUATAUAVH
SUATAUAV
SHA1 block transform for x86_64, CRYPTOGAMS by <https://github.com/dot-asm>
zot$p
USATAUAVAWWH
X25519 primitives for x86_64, CRYPTOGAMS by <https://github.com/dot-asm>
>H3ODH
D$(ATAUAVH
Azol$
Azol$
Azol$0
Aynd$
Aynt$
F(rif
zot$ A
Azof
zoWPE1
ynA<M
Camellia for x86_64 by <https://github.com/dot-asm>
expa
onpf
yoL$P
bSEHC
rabq
.bq~H
Poly1305 for x86_64, CRYPTOGAMS by <https://github.com/dot-asm>
GF(2^m) Multiplication for x86_64, CRYPTOGAMS by <https://github.com/dot-asm>
yot$P
b3eHD
bse@D
bce@D
b3EHD
Ho%.DH
o%RQC
@SUATAVAWH
t$ AVH
@SWATAUAVH
|$ ATAVAWH
l$ VWATAVAWH
T$Efff
|$ ATAVAWL
|$ ATAUAVAW3
|$ ATAVAWeH
l$ WATAWH
|$ ATAUAVAW
LLZH
VWATAUAWH
|$ ATAUAVAWL
H;APr
H;Apr
H;Axr
VWATAVAWH
@SUVWATH
=.fC
preparinM9
game-accM9
game-staM9
rtinu
injectinM9
8Donet
8doneu
T$XIc
H;AHr
WATAUAVAW
one byteH9
8.uLH
UWATAVAWH
encodingH
@USVWATAUAVAWH
Length: H
UVWATAWH
H9Ehs
GEPD
H;Epr
t$ UWATAVAWH
H;upr
<x.uVH
GEHH
H;AXr
H;Ahr
=%d)
@USVWATAVAWH
expaA
@USWH
p WAVE3
D$ expa
USWI
@USVWH
USVWATAUAVAWH
orpf
D3ADD#
ELA3sTA3{XA3[\E
D1UdD1MhD1El
l$ VWATH
VATAUAVH
@SATAUH
tASH
x uED
l$ AVH
t$ ATAVAWH
@UVATAUAVH
t$ WATAWH
@SUVATAUH
tprG
t.SH
\$ VWATAUAVH
@SUVATAVH
t$ AWH
t29oxH
tofH
P.fD
22222222222222222222222222222222222222
2222222222222222
\$ UVWATAWH
L$ UVATAVAWH
tNSH
@SVATAUAWH
SUVWATAUH
@USVH
{ ATAVAWH
@SUATAUAWH
@USATAVH
@USWATAUAVAWH
VWATAUH
master sH9
ecreu
nsiou
ntoI
@VWATAUAVH

Stack and decoded strings were not recovered: this file format is not eligible for string emulation. Only literal strings present in the file are listed above.

Disassembly

entry point · x64 · 60 insns (listing capped)

AddressBytesMnemonicOperands

0x1403e9a904883ec28subrsp, 0x28

0x1403e9a94e88b020000call0x1403e9d24

0x1403e9a994883c428addrsp, 0x28

0x1403e9a9de972feffffjmp0x1403e9914

0x1403e9aa2ccint3

0x1403e9aa3ccint3

0x1403e9aa4488d0515c81300learax, [rip + 0x13c815]

0x1403e9aab48c7411000000000movqword ptr [rcx + 0x10], 0

0x1403e9ab348894108movqword ptr [rcx + 8], rax

0x1403e9ab7488d05f2c71300learax, [rip + 0x13c7f2]

0x1403e9abe488901movqword ptr [rcx], rax

0x1403e9ac1488bc1movrax, rcx

0x1403e9ac4c3ret

0x1403e9ac5ccint3

0x1403e9ac6ccint3

0x1403e9ac7ccint3

0x1403e9ac84883ec48subrsp, 0x48

0x1403e9acc488d4c2420learcx, [rsp + 0x20]

0x1403e9ad1e8ceffffffcall0x1403e9aa4

0x1403e9ad6488d15e3571600leardx, [rip + 0x1657e3]

0x1403e9add488d4c2420learcx, [rsp + 0x20]

0x1403e9ae2e8c5030000call0x1403e9eac

0x1403e9ae7ccint3

0x1403e9ae8e98b040000jmp0x1403e9f78

0x1403e9aedccint3

0x1403e9aeeccint3

0x1403e9aefccint3

0x1403e9af033c0xoreax, eax

0x1403e9af23905782a1d00cmpdword ptr [rip + 0x1d2a78], eax

0x1403e9af80f95c0setneal

0x1403e9afbc3ret

0x1403e9afcc7058a7a250000000000movdword ptr [rip + 0x257a8a], 0

0x1403e9b06c3ret

0x1403e9b07ccint3

0x1403e9b0848895c2408movqword ptr [rsp + 8], rbx

0x1403e9b0d55pushrbp

0x1403e9b0e488dac2440fbfffflearbp, [rsp - 0x4c0]

0x1403e9b164881ecc0050000subrsp, 0x5c0

0x1403e9b1d8bd9movebx, ecx

0x1403e9b1fb917000000movecx, 0x17

0x1403e9b24ff15b6760000callqword ptr [rip + 0x76b6]

0x1403e9b2a85c0testeax, eax

0x1403e9b2c7404je0x1403e9b32

0x1403e9b2e8bcbmovecx, ebx

0x1403e9b30cd29int0x29

0x1403e9b32b903000000movecx, 3

0x1403e9b37e8c0ffffffcall0x1403e9afc

0x1403e9b3c33d2xoredx, edx

0x1403e9b3e488d4df0learcx, [rbp - 0x10]

0x1403e9b4241b8d0040000movr8d, 0x4d0

0x1403e9b48e87d030000call0x1403e9eca

0x1403e9b4d488d4df0learcx, [rbp - 0x10]

0x1403e9b51ff1561760000callqword ptr [rip + 0x7661]

0x1403e9b57488b9de8000000movrbx, qword ptr [rbp + 0xe8]

0x1403e9b5e488d95d8040000leardx, [rbp + 0x4d8]

0x1403e9b65488bcbmovrcx, rbx

0x1403e9b684533c0xorr8d, r8d

0x1403e9b6bff154f760000callqword ptr [rip + 0x764f]

0x1403e9b714885c0testrax, rax

0x1403e9b74743fje0x1403e9bb5

callbranchretstackarithregisterimmediatememory

Import fingerprint

no related sample

Fingerprint	192:LYTazXZTPpdhXhW5WPXREI8aJrxkbBYe0JkyXxA:LYTaRpdhXhusX+CXe0VXxA
Imports read	423 functions from 23 libraries (423 distinct)
Comparable	yes
Compared against	22 stored samples

Samples built on the same import table

No stored sample you can see shares this import table.

Screen recording

91 frames · screen recording · 147s · ended early

The run was ended early from the console, so the recording covers only the 147s the sample actually ran.

1 / 91

0:00 · 1/91

Download this recording Download video (.mp4) Download GIF (.gif) Building the file runs an encode on this platform, so it is kept to signed-in accounts. Signing in brings you back to this report.

Behavior summary

ran 146s · ended early

71 process(es) observed

LaunchedC:\Users\user\Desktop\slinky__4_.exe

Privilegestandard

Uncommon Child Process Of Conhost.EXE [T1202]

Telemetry sources: Kernel ETW (0 events) agent poll: 60Process audit: 76 1 kernel-only process

Evasion / anti-analysis checks

7 checks

HIGH

VM-detection query: Win32_ComputerSystem dynamic-query

MITRE T1497.001 · wmi

HIGH

VM-detection query: Win32_BIOS dynamic-query

MITRE T1497.001 · wmi

HIGH

VM-detection query: Win32_PNPEntity dynamic-query

MITRE T1497.001 · wmi

MED

CPUID hypervisor/feature probe static-instruction

MITRE T1497.001 · 10x cpuid

MED

RDTSC timing check static-instruction

MITRE T1497.003 · 6x rdtsc

MED

Anti-debug API imports static-api

MITRE T1622 · isdebuggerpresent

MED

YARA: Suspicious_Anti_Debug_API Signature

MITRE T1497

Statically visible checks (RDTSC/CPUID/red-pill instructions, anti-debug APIs) plus runtime evasion signals. Instruction-level interception at runtime requires hypervisor introspection (VMI).

WMI activity

3 classes

WMI classes the sample queried, captured from the WMI-Activity trace and attributed to the sample process tree. Hardware/identity classes also surface as VM-detection checks above.

Win32_ComputerSystemWin32_BIOSWin32_PNPEntity

WMI method invocations

1 call

Methods the sample invoked through WMI, with their arguments. A process created this way is spawned by the WMI provider host, so the operating system records no parent link back to the sample - the caller is named by the WMI-Activity trace and the argument is captured in the calling process itself.

Connect pid 5332

Command lines, unwrapped

4 read

4 captured texts were read and unwrapped locally. No address was recovered from any of them, and none of them was hiding its own contents behind an encoding or a format string. This is a result, not a gap.

Network activity

The network section is a paid-plan layer: the DNS the sample resolved, the connections it opened, the TLS it negotiated, and the rule engine's reading of the capture.

This run was captured, and what it captured is on a paid plan rather than absent. An internet-connected detonation is the same plan, so a paid run also shows what the sample reached rather than only what it tried.

See plans Create an account

Process tree

What ran during the detonation, and what each process did. Select a node to see the activity attributed to it.

71processes

slinky (4).exe

71 processes

Attributed activity

0Mechanisms found

90Methods checked

0ATT&CK techniques

NONEHighest severity

Persistence mechanisms

clean

No persistence established

None of the 90 auto-start methods below were established during this run.

Detection coverage

0 / 90

Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean, and one the sample only names in its own strings reads "named" rather than "detected".

Logon & Startup 22 clean

Active Setup Installed Component T1547.014 clean
Explorer Delay-Load Object T1547.001 clean
Explorer Run Key T1547.001 clean
Explorer SharedTaskScheduler T1547.001 clean
Group Policy Extension DLL T1547.004 clean
Group Policy Run Key T1547.001 clean
Logon Script T1037.001 clean
RDP WDS Startup Program T1547.001 clean
Registry Run Key T1547.001 clean
Registry RunEx Key T1547.001 clean
Registry RunOnce Key T1547.001 clean
Registry RunOnceEx Key T1547.001 clean
Registry RunServices Key T1547.001 clean
Startup Folder Item T1547.001 clean
Startup Folder Redirection T1547.001 clean
Terminal Services Initial Program T1547.001 clean
Winlogon GINA DLL T1547.004 clean
Winlogon MPNotify Value T1547.004 clean
Winlogon Notify Package T1547.004 clean
Winlogon Shell Value T1547.004 clean
Winlogon Taskman Value T1547.004 clean
Winlogon Userinit Value T1547.004 clean

Services & Tasks 9 clean

BITS Job T1197 clean
Print Monitor DLL T1547.010 clean
Print Processor DLL T1547.012 clean
Scheduled Task T1053.005 clean
Scheduled Task Registry Implant T1053.005 clean
Service Control Manager Security Descriptor T1574.011 clean
Service DLL Hijack T1543.003 clean
Time Provider DLL T1547.003 clean
Windows Service Creation T1543.003 clean

Execution Hijack 17 clean

.NET Managed Debugger T1546.012 clean
Accessibility Tool Hijack T1546.008 clean
AeDebug Postmortem Debugger T1546.012 clean
App Paths Hijack T1546.012 clean
Application Shim Database T1546.011 clean
Boot Verification Program T1547.002 clean
Command Processor AutoRun T1546.011 clean
Explorer Load Value T1547.001 clean
Explorer MyComputer Tool Hijack T1546.001 clean
Registry Image File Execution Options T1546.012 clean
Screensaver Hijack T1546.002 clean
Setup ErrorHandler Script T1546 clean
Shell Open Command Hijack T1546.001 clean
SilentProcessExit Monitor T1546.012 clean
Telemetry Controller Command T1546.015 clean
WER ReflectDebugger T1546.012 clean
Windows Error Reporting Debugger T1546.012 clean

DLL Load Order 12 clean

.NET CLR Profiler DLL T1574.012 clean
.NET Startup Hook DLL T1574 clean
AppCert DLLs T1546.009 clean
AppInit DLLs T1546.010 clean
AutodialDLL Winsock Injection T1546.006 clean
DLL Search-Order Hijack T1574.001 T1574.002 clean
DNS Server Plugin DLL T1574.001 clean
HTML Help Helper DLL T1546 clean
KnownDLLs Manipulation T1574.001 clean
Natural Language Platform DLL Override T1546 clean
Netsh Helper DLL T1546.007 clean
Winsock Layered Service Provider T1546.006 clean

COM & Browser 6 clean

Browser Extension T1176 clean
Browser Helper Object T1176 clean
COM Server Hijack T1546.015 clean
HTML Help COM Object Hijack T1546.015 clean
Shell Context Menu Handler T1546.001 clean
Shell Extension Handler T1546.001 clean

Security Providers & Accounts 11 clean

Account RID Hijack T1098 clean
AMSI Provider T1562.001 clean
Credential Provider T1547.014 clean
DSRM Admin Logon Backdoor T1556 clean
Hidden Local Account T1136.001 clean
LSA Authentication Package T1547.002 clean
LSA Extension DLL T1547.005 clean
LSA Notification Package T1547.005 clean
LSA Security Package T1547.005 clean
Network Provider DLL T1556.008 clean
Security Support Provider T1547.005 clean

Scripting & Applications 9 clean

Netsh Port Proxy T1090.001 clean
Office Add-in T1137.006 clean
Office Executable Sideload T1574.002 clean
Office Startup Template T1137.001 clean
Office Test Key T1137.002 clean
Power Automate Flow T1546 clean
PowerShell Profile T1546.013 clean
Windows Terminal Startup Action T1546 clean
WMI Event Subscription T1546.003 clean

Boot & Firmware 4 clean

BootExecute Native Image T1547.002 clean
PlatformExecute Native Image T1547.002 clean
SetupExecute Native Image T1547.002 clean
UEFI / Bootkit Artifact T1542.003 T1542.001 clean

File activity summary

create 0 write 0 modify 0 delete 0 rename 0

Dropped payload analysis

none kept

The sample ran and none of what it wrote was a payload this run kept and examined. That is a measured absence rather than an unasked question.

File & registry ops

0 file · 0 registry · sample scope

Files (0) Registry (0)

Operation	Target	Process
create	Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ certificate store	slinky__4_.exe pid 5720

External reputation was not produced for this scan. Threat intelligence enrichment is a paid-plan layer: every extracted indicator - hashes, addresses, hostnames - is checked against the external reputation services. Our own ingested feeds ran on this scan and every result below is theirs. Adding the paid layer adds an external reputation verdict on each indicator, so VirusTotal, MalwareBazaar and filescan.io are listed below as not checked. See plans.

3 reported a hit 15 answered no 5 had nothing to check

3Sources with a hit

18Sources queriedof 23 available

470.1kFeed records

0Could not answer

File reputation

4 clear · 3 not checked

Source	Checks	Result	Detail	Feed
MalwareBazaar hash feed	File hash	clean	not in feed	2,697 records 39 minutes ago
MalwareBazaar ransomware feed	File hash	clean	not in feed	3,348 records 56 minutes ago
ThreatFox hash IOCs	File hash	clean	not in feed	954 records 39 minutes ago
URLhaus payload hashes	File hash	clean	not in feed	1,878 records 39 minutes ago
filescan.io	File hash	not checked	no hash lookup ran for this scan	live lookup
MalwareBazaar	File hash	not checked	no hash lookup ran for this scan	live lookup
VirusTotal	File hash	not checked	no hash lookup ran for this scan	live lookup

Hash lookups only - the sample itself is never uploaded to any third party.

Network indicators

1 of 8 listed

Source	Checks	Result	Detail	Feed
URLhaus	IP / domain / URL	1 indicator	hxxps[://]github[.]com/dot-asm	no records ingested
blocklist.de	IP / domain / URL	clean	1 observed indicator, none listed	27.6k records 39 minutes ago
CINS Army	IP / domain / URL	clean	1 observed indicator, none listed	15k records 39 minutes ago
Emerging Threats	IP / domain / URL	clean	1 observed indicator, none listed	482 records 39 minutes ago
Feodo Tracker	IP / domain / URL	clean	1 observed indicator, none listed	5 records 39 minutes ago
IPsum	IP / domain / URL	clean	1 observed indicator, none listed	19.7k records 39 minutes ago
Phishing.Database	IP / domain / URL	clean	1 observed indicator, none listed	391.5k records 58 minutes ago
ThreatFox	IP / domain / URL	clean	1 observed indicator, none listed	954 records 39 minutes ago

TLS fingerprints

nothing of this kind to check

Source	Checks	Result	Detail	Feed
JA3 / JA4 fingerprint blocklists	JA3 / JA4	not checked	no TLS client fingerprint observed	97 records 13 hours ago
SSL blocklist	Server certificate	not checked	no server certificate fingerprint is extracted to check	live lookup

Detection rules

2 of 2 listed

Source	Checks	Result	Detail	Feed
Sigma rules	Behavior log	1 match	Uncommon Child Process Of Conhost.EXE	2,275 records 8 hours ago
Signature rules	Sample content	1 match	Suspicious_Anti_Debug_API	110 records 39 minutes ago

Tooling catalogs

4 clear

Source	Checks	Result	Detail	Feed
LOLBAS	Process image paths	clean	71 process image paths, none masqueraded	245 records 39 minutes ago
LOLBootloaders	File hash	clean	not a known vulnerable bootloader	520 records 38 minutes ago
LOLDrivers	File hash	clean	not a known vulnerable driver	2,333 records 39 minutes ago
LOLRMM	Names and domains	clean	72 name/domain indicators checked, no remote-management tooling	360 records 39 minutes ago

AI analysis

The AI layer is a paid-plan feature. It reads what the other layers produced - the behaviour summary, the call sequence, the indicator list - and writes the narrative and the kill-chain walkthrough.

Nothing is being withheld. This layer did not run for this scan, so there is no result stored behind the lock.

See plans Create an account

0 malicious 3 suspicious 0 info

File indicators

Severity	Type	Indicator	Description
suspicious	sample_sha256	bcbeee5254a8ac6b2697923056113f8b95a7ef676b671564e6fbd2795d1d0e31	Submitted sample (SHA256)
suspicious	sample_md5	a6e18b539a74266551bb501e678fb586	Submitted sample (MD5)
suspicious	imphash	9bb5d6d9a3b1401e1122ae113736321c	Import table hash (imphash)

MITRE ATT&CK

1 technique

Uncommon Child Process Of Conhost.EXE

T1202

Sigma detections

1 match of 2275 rules

Level	Detection	Log source	ATT&CK	Evidence
Medium	Uncommon Child Process Of Conhost.EXE Detects uncommon "conhost" child processes. This could be a sign of "conhost" usage as a LOLBIN or potential process injection activity.	process_creation	T1202	process pid=1180

Generated rules

No generated rules

Detection rules are auto-generated after analysis.

Extracted files

What came out of the sample: unpacked payloads, carved objects and captured memory. Each one is stored by content hash, so the same object extracted twice is the same row.

No extracted files

Nothing was unpacked or carved out of this sample. Packed samples, documents with embedded objects and installers are the ones that usually produce artifacts here.

Export & download

/s/2735

ATT&CK Navigator STIX 2.1 MISP IOCs PCAP Get Sample

Structured exports for your SIEM/TIP - ATT&CK Navigator layer, STIX 2.1 bundle, MISP event and a defanged IOC list - are free on every report. The packet capture follows this scan's plan, because a capture is the rawest network output this platform produces.

AI analysis report

An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).

Public analyses of this file

1 run

Submitted	Environment	Verdict	Score
2026-10-12 19:04 Shown below	Windows 10 22H2	Suspicious	35/100

slinky (4).exePE analysis report - Suspicious

Run integrity

Why this verdict

Model reading

Analysis layers

Sample

Run conditions

Detection signatures

What the tests returned

Arguing against malice

How much weight this carries

Instrument coverage

Structure

Sections & resources

Signatures & packing

Strings

Code

Antivirus engine

Local ML assessment

Family configuration search

Secrets & malicious strings

Flagged string categories

Capabilities

Security mitigations

Rich header (toolchain)

Sections

Imports

Binary metadata

Code signing

Resources

Resources

Similar samples

Capability detection

Signature matches

Extracted strings

Disassembly

Nothing in this view

Import fingerprint

Screen recording

Behavior summary

Evasion / anti-analysis checks

WMI activity

WMI method invocations

Command lines, unwrapped

Network activity

Process tree

slinky (4).exe

Attributed activity

Persistence mechanisms

No persistence established

Detection coverage

File activity summary

Dropped payload analysis

File & registry ops

File reputation

Network indicators

TLS fingerprints

Detection rules

Tooling catalogs

AI analysis

File indicators

MITRE ATT&CK

Sigma detections

Generated rules

No generated rules

Extracted files

No extracted files

Export & download

AI analysis report

Public analyses of this file