SilentColor[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

SilentColor.exe
Size

13.5MB
MD5

88b6231acb6b608d8fccc35edf392070
SHA1

d6cd5788fb5f0a12763dc2b2942e1403c394553c
SHA256

07e15631b516183f0b2f18f8dc50988a47d677a69527fe8e6311fa5c239b3f60
SHA512

039a350fa43c9ac44ab3bef1a0cefd2ab554643d1969961f26821283cb923827178274c2b71453f935eb5c44d1c65fd4607cbfd26e6aa43fc10cef8dc9e0083e
SSDEEP

393216:enoiB4/ZLcgn2H9Zv7QX0EzU+XXvVUZTfuAJu7VwkVNryr:eBCZggwj7QZI+GRBJupwu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SilentColor.exe

Files

SilentColor.exe
.exe windows:6 windows x64 arch:x64

6b6ae2627481130a025dc86169eb867a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegQueryValueA

kernel32

GetModuleHandleA

shell32

SHChangeNotifyRegister

user32

GetCursor

Sections

Size: - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: - Virtual size: 390KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 11.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE