CreateInterface
Static task
static1
Behavioral task
behavioral1
Sample
cof.exe
Resource
win10-20230703-en
General
-
Target
cof.exe
-
Size
88KB
-
MD5
97db62d74ec192e8c576af0f7e25a8a7
-
SHA1
6897bb9058c5c5230a6234c7760db5e3b7eb7f68
-
SHA256
e3a14dbbfabfc6b6116efc3e34d661d93b5936b0e2b435e45ffaab8e14ce1291
-
SHA512
ff544925da447a7e91f82511559ef142c0747154297cb2ba6a4ae41120d0ef591b6850118d33400646034968ef374f58fe39ebc6fe820da773fad168705de310
-
SSDEEP
1536:UUEtXr0hFBKexYTMUD9dRqTjG/0OxkkV1gx+7yBkO6ESmooNSaSZFOIt:U/tbwFRY0w0iZV1O+7yBZpSmooNSjjt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cof.exe
Files
-
cof.exe.exe windows x86
b3b0ad92c8bb9dcebe36d7de9fa58b16
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
wsock32
WSAStartup
WSACleanup
kernel32
GetModuleHandleA
GetLongPathNameA
GetModuleFileNameA
CloseHandle
ReleaseMutex
GetCommandLineA
WaitForSingleObject
FreeLibrary
CreateMutexA
GetCurrentDirectoryA
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
SetEndOfFile
LoadLibraryA
GetProcAddress
GetUserDefaultLCID
GetVersionExA
GetLastError
LeaveCriticalSection
FindFirstFileA
FindNextFileA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
MultiByteToWideChar
HeapAlloc
HeapFree
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
GetDriveTypeA
SetEnvironmentVariableA
SetCurrentDirectoryA
GetStartupInfoA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
HeapSize
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
GetLocaleInfoW
FatalAppExitA
SetEnvironmentVariableW
WideCharToMultiByte
HeapDestroy
HeapCreate
GetFullPathNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetCurrentThread
RtlUnwind
WriteFile
GetStringTypeA
GetStringTypeW
InterlockedDecrement
InterlockedIncrement
SetStdHandle
FlushFileBuffers
ReadFile
CreateFileA
SetFilePointer
GetTimeZoneInformation
GetCPInfo
CompareStringA
CompareStringW
GetACP
GetOEMCP
LCMapStringA
LCMapStringW
GetFileAttributesA
GetExitCodeProcess
CreateProcessA
Sleep
user32
FindWindowA
PostMessageA
wsprintfA
MessageBoxA
advapi32
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegOpenKeyA
Exports
Exports
Sections
.text Size: 56KB - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 33.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ