FishyColor[.]exe | Triage

Sharing

General

Target

FishyColor.exe
Size

22.9MB
MD5

b18e5af11989bba7b7c19cf10441685a
SHA1

3bba74d8d1e33e553f57a43d0d5fc2c6f5d8dbbb
SHA256

ca7c7c9e18f00076f346908f15b1d43041a10ff86ec1169c2f7a0458f0a40945
SHA512

6c632b91ed29bb97d7576ec24bf959a7e24085ff2ea2197bcda6677281155b96368327a3ba17eeb0ba29e2a18800518ab4ba8a070d69695651f3561c82a754d5
SSDEEP

393216:H5LoU6TOMAILuCCUIoWpI1K1uojnakRVCAFweg8peKBkl/SwPNYZpDqIe/st3qq8:H5L6OMAUcroWpQK1ucnakRVlWegWS6wB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FishyColor.exe

Files

FishyColor.exe
.exe windows:6 windows x64 arch:x64

234c9c2135139a8cf4d26a5ea1b258d4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegCloseKey

kernel32

GetModuleHandleA

shell32

SHGetDiskFreeSpaceA

user32

CharNextA

Sections

Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: - Virtual size: 10.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 11.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE