Behavioral task
behavioral1
Sample
1292550x00000000009200000.dll
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
1292550x00000000009200000.dll
Resource
win10v2004-20230621-en
General
-
Target
1292550x00000000009200000.dmp
-
Size
244KB
-
MD5
dad6c2ded3e8d06b0acff1ffa1bdf5a9
-
SHA1
914e40f0b17c77d0a4dcdc30fc07bb1530a0d05f
-
SHA256
675ca2acf23ae223495481b76681f409bcbc062981a5af35ae9fcb657a3a87b3
-
SHA512
e5086ae1d3ab6ef45f1adc3227ccab771f5023776d138977fbf48b896a3663d330124eaedf2d936b358b6612b676444906d4bcc5f0e51aeb46be77015dbde115
-
SSDEEP
3072:yvM7/EfoGq9hqb4u4fLiYr2D3o7CvVsr56tdj1UX854nwO5z:3EfPq9sqDiYraozr56vjepwO
Malware Config
Signatures
-
Cobalt Strike reflective loader 1 IoCs
Detects the reflective loader used by Cobalt Strike.
resource yara_rule sample cobalt_reflective_dll -
Cobaltstrike family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1292550x00000000009200000.dmp
Files
-
1292550x00000000009200000.dmp.dll windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
.text Size: 145KB - Virtual size: 145KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ