cosba64[.]exe | Triage

Sharing

General

Target

cosba64.exe
Size

238.2MB
MD5

f08f7876b0414cee5a471f456790ecd3
SHA1

935928cfa2e1ba8d4a0afbfe3f89d8f72c6b344f
SHA256

4c01488b3e16e21aeaef9fb3ea1e66ebb5b5d8b41b5b1d0797d2686020a48c28
SHA512

f9a248d6e93308bfbc23adf164c63284aa3d5c13a337e632746f400213afd0af21ccd43bca492d321d675e740dad923bfc909090f575430ff9042c551dc5217d
SSDEEP

98304:efoB/2sOjbllT1/gTA/8DGEWXrwR75sIQpz5MNv4xi3npUmcLBgy2enlHnRJsNPb:enljn14L9WXr67xQLMSMpZcLRJnGb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cosba64.exe

Files

cosba64.exe
.exe windows x86

c4e57a0a2b30a323e3eeb1b8941df733

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExW
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress

user32

GetSystemMetrics

gdi32

CreateCompatibleBitmap

advapi32

RegCloseKey

shell32

SHGetFolderPathA

wininet

HttpOpenRequestA

gdiplus

GdipSaveImageToFile

Sections

.text
Size: 157KB - Virtual size: 156KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.baca0
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.baca1
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.baca2
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 363KB - Virtual size: 363KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ