Alliance[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Alliance.exe
Size

23.7MB
MD5

7f9d5a3a8a03c865f45fbab66aeea4eb
SHA1

2b06a6d222e71f7fbfe83a3a7b9e209b3092530d
SHA256

d9deecbdd786b3d2b7301057aba490a16388c19ee8b48f5da7158a310a224f24
SHA512

61f298a50354e15cd228c616edff27cfac76b4dd2a30d6081eff4ecb778faa40d79642bf2a914ce415a170efd44a46f375726cd22c718131c32b48809a4f71c1
SSDEEP

393216:SuybrkyR7f17TZl5+ezea1SzZgpCDorSYHlV4XvmiWpMqlyQFfnjMY4mUoSjP2VS:1JyR7f1x+oe5gp0EFKmUqlLMYSjPgqb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Alliance.exe

Files

Alliance.exe
.exe windows:6 windows x64 arch:x64

10431677e7b8961565206c89962f307b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegQueryValueW

kernel32

GetModuleHandleA

shell32

SHGetDiskFreeSpaceA

user32

MessageBoxW

Sections

Size: - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: - Virtual size: 10.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 12.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE