AlianceColor[.]exe | Triage

Sharing

General

Target

AlianceColor.exe
Size

23.7MB
MD5

11dcefe64c4cca0b171280bf793ebfe7
SHA1

70f8e1a18c8d8d814a2c4ac6dae20649ad00e0c9
SHA256

819fab4a356b22c4554c84c01b9e00353dfbe4e393ebbd03c42538024bea0e39
SHA512

4770a92c5746b051f4311fd7db8229e8d71ba57be046a8204ca4fec17861d67159de0067e9be703e7453e8da1d4965f9fbcaa947fad203a856c73e73702331ae
SSDEEP

393216:EnDnzaJAdIOuIjtURGZgTdm1aqMF3dxQ7l2CEbWUXqdbvpFnbBJ3jXG5ll:K2iIlQiAgTk1aFdxQMCEbWUXizb/z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AlianceColor.exe

Files

AlianceColor.exe
.exe windows:6 windows x64 arch:x64

13e653f38b061caa850461d4b301d512

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegisterEventSourceA

kernel32

GetModuleHandleA

shell32

DragFinish

user32

RegisterClassExW

Sections

Size: - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: - Virtual size: 10.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 12.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE