Yellow[.]exe | Triage

Sharing

General

Target

Yellow.exe
Size

341KB
MD5

c164b7fe11a08a813729f746b87d5337
SHA1

fc820d5e32c0e4771eaed886ad7eb048292c1c10
SHA256

6238893de251eb7a3b61b171129dfc45afb8de90aaebe85da8e945ae1e095be3
SHA512

0c7a93c471022728c1b347e0b99e01eb0531b25545f729def76c80cf96ab9164f1b9c817f681b98c33e5fd47d445171bacb3b99de470dfb0016ac047d185d37e
SSDEEP

6144:zwq4cC+0gbd4/1p81WwbQdn/0brt0PrS97ulN1aeTi:zwqp/4CO/0brt0PrS97uq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Yellow.exe

Files

Yellow.exe
.exe windows:4 windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 301KB - Virtual size: 301KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ