TokenBrokerCookies[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

TokenBrokerCookies.exe
Size

21KB
MD5

902cf9b4d304d35e080ca2ce66bd7910
SHA1

6ff81f7a37cdf3ab90f730efcb3f0974e7cbdcb3
SHA256

95581ff2a0eb3ee8fc5436b1635f8027c814bb123fe83aee81256a383e51c0af
SHA512

1e63e89b1eab2f91548439d49d3564c804683e24b0b37d8cbaf95572e182ba5becd87bf4d5b28bde2208f8e0d201f555539a432bea668ead042fc79e4253a9cd
SSDEEP

384:T99jjQsKm/9+3Jm4fSKxVeXLsxm1KWl8KcysSQfCW9KWATQF:59vQlWA44f7jKDl/cLSaJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TokenBrokerCookies.exe

Files

TokenBrokerCookies.exe
.exe windows x86

3b0eb4d4c6819bef51f84d8169d3f34f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
??1type_info@@UAE@XZ
memcpy
__CxxFrameHandler3
??3@YAXPAX@Z
_CxxThrowException
?what@exception@@UBEPBDXZ
_controlfp
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
_callnewh
malloc
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
_purecall
__p__commode
_except_handler4_common
memmove
_XcptFilter
memset

api-ms-win-security-base-l1-2-0

GetTokenInformation

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleA

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
TerminateProcess
OpenProcessToken
GetCurrentProcessId
GetCurrentProcess

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventUnregister
EventSetInformation

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount

wininet

InternetSetCookieEx2

ntdll

_wtoi

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3b0eb4d4c6819bef51f84d8169d3f34f

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-security-base-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-security-sddl-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

wininet

ntdll

api-ms-win-core-delayload-l1-1-1

Sections

.text Size: 13KB - Virtual size: 13KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 2KB - Virtual size: 2KB

.didat Size: 512B - Virtual size: 8B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 13KB - Virtual size: 13KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 2KB - Virtual size: 2KB

.didat
Size: 512B - Virtual size: 8B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB