cosmo_loader[.]exe | Triage

Sharing

General

Target

cosmo_loader.exe
Size

857KB
MD5

da955fd7e73d829089f5d54b09c9431e
SHA1

8c4c6edef28424046b43e941f3116c6df853f1b8
SHA256

b3eb3eb58d5a13a43f895c983a43598ec9dc7792ef26b71e01876c190a21804a
SHA512

e8d9eb029a116a0a175c2a6968467ebee6dd80bcbf54d67167dced4ffae4d070be71efea424a4ce8e1ea442830855cc7d2ffc420218c432afde391c7f68ce09b
SSDEEP

24576:n0lmdMh/aYYRVvMSUW1ODC8obhXawu9M:0lmdKYjMSU0mCFbhzi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cosmo_loader.exe

Files

cosmo_loader.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

F:\paysons sources\SubZeroFN Spoofer\Free Temp\free woofer c#\slyzz perm reamke\slyzz remake\niggerspoofa\obj\Release\niggerspoofa.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 851KB - Virtual size: 851KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ