TokenBrokerCookies[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

TokenBrokerCookies.exe
Size

21KB
MD5

d534962e54221e27940398ab353eb45c
SHA1

1cb3199cffa98e4467777be7b28a49b9d362f264
SHA256

b2fc3c0456c000f0166a0c3081a567a32c9fdcfb1d2b36be21a51476ae366919
SHA512

f3a6a971d6ac42c953cc5cbe1b829068056d5b1d22fffb0a67928ab695f378285f603eb63c7e6cdf61be643264a20aa34b3152cef2b472eec59d683be02b9ec6
SSDEEP

384:T9NjjQsKmzN+3Jm4fSKxVeXLsxm1KWl8KcysSQpOWSKWSTQF:ZNvQlGQ44f7jKDl/cLSIC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TokenBrokerCookies.exe

Files

TokenBrokerCookies.exe
.exe windows:10 windows x86

3b0eb4d4c6819bef51f84d8169d3f34f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
??1type_info@@UAE@XZ
memcpy
__CxxFrameHandler3
??3@YAXPAX@Z
_CxxThrowException
?what@exception@@UBEPBDXZ
_controlfp
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
_callnewh
malloc
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
_purecall
__p__commode
_except_handler4_common
memmove
_XcptFilter
memset

api-ms-win-security-base-l1-2-0

GetTokenInformation

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleA

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
TerminateProcess
OpenProcessToken
GetCurrentProcessId
GetCurrentProcess

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventUnregister
EventSetInformation

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount

wininet

InternetSetCookieEx2

ntdll

_wtoi

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3b0eb4d4c6819bef51f84d8169d3f34f

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-security-base-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-security-sddl-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

wininet

ntdll

api-ms-win-core-delayload-l1-1-1

Sections

.text Size: 13KB - Virtual size: 13KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 2KB - Virtual size: 2KB

.didat Size: 512B - Virtual size: 8B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 13KB - Virtual size: 13KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 2KB - Virtual size: 2KB

.didat
Size: 512B - Virtual size: 8B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB