Static task
static1
Behavioral task
behavioral1
Sample
cofire.exe
Resource
win10v2004-20231020-en
General
-
Target
cofire.exe
-
Size
40KB
-
MD5
cefb8cdb524fc6d4da2bba5df695d551
-
SHA1
bb6558c57629bc0eddab412f982ad4cbecd64826
-
SHA256
f940989914449c633272230a78c83fa587844971075734d6f10644aa5a354dcb
-
SHA512
0c61ee12ebf6fcb1a4093857c8982de12223b390cde8c56dc64b18d88da4a91e53b9b1009905d56082cdea20d33c411f84a05cb1016977dde18a9d66e8b5b8d9
-
SSDEEP
384:a7/5vJBArLKvG9zoM0qXCeTvhNMlCLA8qE/704RazygB2mAicMumWEJWf:a7gLKgVXCUvU8qswpB2mEMuM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cofire.exe
Files
-
cofire.exe.exe windows:10 windows x64 arch:x64
49c319693a3f09328afcb91c7f2e2cbe
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
EventUnregister
EventRegister
EventWrite
CheckTokenMembership
FreeSid
OpenProcessToken
AllocateAndInitializeSid
InitiateShutdownW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
kernel32
GetLastError
HeapSetInformation
RegisterApplicationRestart
FindFirstFileW
HeapFree
CreateMutexW
FindClose
OpenProcess
FileTimeToSystemTime
CloseHandle
HeapAlloc
GetTimeFormatW
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
GetSystemTimeAsFileTime
GetDateFormatW
Sleep
SetUnhandledExceptionFilter
WaitForSingleObject
QueryPerformanceCounter
GetCurrentThreadId
GetTickCount
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetThreadLocale
msvcrt
_vsnprintf
_cexit
_exit
__set_app_type
__wgetmainargs
_amsg_exit
_vsnwprintf
__C_specific_handler
?terminate@@YAXXZ
_fmode
_commode
exit
_initterm
__setusermatherr
_XcptFilter
memset
ntdll
WinSqmAddToStream
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
DbgPrintEx
wdi
WdiResolve
WdiGetResult
WdiGetParameterByName
WdiGetParameterDataLength
WdiCreateInstance
WdiGetParameterData
WdiAddParameter
WdiDiagnose
WdiCloseInstance
comctl32
ord345
user32
LoadStringW
MessageBoxW
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
Sections
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 444B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ