cof[.]exe | Triage™

General

Target
cof.exe
Size 88KB
Sample230722-eg3ydshe98
SHA256 e3a14dbbfabfc6b6116efc3e34d661d93b5936b0e2b435e45ffaab8e14ce1291
MD5 97db62d74ec192e8c576af0f7e25a8a7
SHA1 6897bb9058c5c5230a6234c7760db5e3b7eb7f68
SHA512 ff544925da447a7e91f82511559ef142c0747154297cb2ba6a4ae41120d0ef591b6850118d33400646034968ef374f58fe39ebc6fe820da773fad168705de310
SSDEEP 1536:UUEtXr0hFBKexYTMUD9dRqTjG/0OxkkV1gx+7yBkO6ESmooNSaSZFOIt:U/tbwFRY0w0iZV1O+7yBZpSmooNSjjt
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cof.exe

File Explorer

cof.exe

.exe 88KB

cof.exe

IMPHASH b3b0ad92c8bb9dcebe36d7de9fa58b16
SHA256 e3a14dbbfabfc6b6116efc3e34d661d93b5936b0e2b435e45ffaab8e14ce1291
MD5 97db62d74ec192e8c576af0f7e25a8a7
SHA1 6897bb9058c5c5230a6234c7760db5e3b7eb7f68
SHA512 ff544925da447a7e91f82511559ef142c0747154297cb2ba6a4ae41120d0ef591b6850118d33400646034968ef374f58fe39ebc6fe820da773fad168705de310
SSDEEP 1536:UUEtXr0hFBKexYTMUD9dRqTjG/0OxkkV1gx+7yBkO6ESmooNSaSZFOIt:U/tbwFRY0w0iZV1O+7yBZpSmooNSjjt
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19326

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

wsock32

WSAStartup WSACleanup

kernel32

GetModuleHandleA GetLongPathNameA GetModuleFileNameA CloseHandle ReleaseMutex GetCommandLineA WaitForSingleObject FreeLibrary CreateMutexA GetCurrentDirectoryA EnumSystemLocalesA GetLocaleInfoA IsValidCodePage IsValidLocale SetEndOfFile LoadLibraryA GetProcAddress GetUserDefaultLCID GetVersionExA GetLastError LeaveCriticalSection FindFirstFileA FindNextFileA FindClose FileTimeToSystemTime FileTimeToLocalFileTime MultiByteToWideChar HeapAlloc HeapFree VirtualFree VirtualAlloc HeapReAlloc IsBadWritePtr GetDriveTypeA SetEnvironmentVariableA SetCurrentDirectoryA GetStartupInfoA GetVersion ExitProcess TerminateProcess GetCurrentProcess HeapSize InitializeCriticalSection DeleteCriticalSection EnterCriticalSection GetLocaleInfoW FatalAppExitA SetEnvironmentVariableW WideCharToMultiByte HeapDestroy HeapCreate GetFullPathNameA UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType GetCurrentThreadId TlsSetValue TlsAlloc TlsFree SetLastError TlsGetValue GetCurrentThread RtlUnwind WriteFile GetStringTypeA GetStringTypeW InterlockedDecrement InterlockedIncrement SetStdHandle FlushFileBuffers ReadFile CreateFileA SetFilePointer GetTimeZoneInformation GetCPInfo CompareStringA CompareStringW GetACP GetOEMCP LCMapStringA LCMapStringW GetFileAttributesA GetExitCodeProcess CreateProcessA Sleep

user32

FindWindowA PostMessageA wsprintfA MessageBoxA

advapi32

RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegOpenKeyA

Sharing