Kobalc[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Kobalc.exe
Size

185KB
MD5

15717cd327a723820d71900611545917
SHA1

99184ec149d329e98cd3e600cfaba22a2f9a0156
SHA256

db6cea7e8d62d3b21efe3b423b48c131e345cb55f168cbe1f142e491bb812747
SHA512

a0de435db809e3e79f89411017e244c76145e010c67f894d41e265804c832f5514ac2f31cc9a0c667afa77aaaf3eccecac148279ca5a0feba492b222d5481a49
SSDEEP

3072:LoixrduqW9Goin4lZoD9d16zVfMZ2KKNRdTaB:0W5jOA96xrRd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Kobalc.exe

Files

Kobalc.exe
.exe windows:4 windows x86 arch:x86

9c90719a27a63779cb01064a4dc4ad66

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

CharUpperBuffA

advapi32

RegQueryValueExA

shell32

SHGetSpecialFolderPathA

ws2_32

bind

mpr

WNetAddConnection2A

oleaut32

GetErrorInfo

version

GetFileVersionInfoSizeA

Sections

.text
Size: 113KB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE