C:\Jenkins\workspace\lds_ml_library_documents_develop@2\x64\Release\docmodel.pdb
Static task
static1
Behavioral task
behavioral1
Sample
cobaltstrike.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
cobaltstrike.dll
Resource
win10v2004-20240508-en
General
-
Target
cobaltstrike.dll
-
Size
374KB
-
MD5
286394d06972734946774c85742a094f
-
SHA1
616415b3ec0c08511d232e56b51faf7a03c45183
-
SHA256
8501e14ee6ee142122746333b936c9ab0fc541328f37b5612b6804e6cdc2c2c6
-
SHA512
1e8e0c408d27721284160e716d8421e2f53ce4176c392ebf1797ce5f6465cfb0abe272e2671fc9809848842f8aac1c586ae5c9c960599215778b8edb3b4d0bcc
-
SSDEEP
6144:yPfFKlojxM82ScMOM2gWfXyRtEmvLMOFIQV5ilTHoZTE4sUsdJn:yPYoORgLE7uIuIpoZgqs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cobaltstrike.dll
Files
-
cobaltstrike.dll.dll windows:6 windows x64 arch:x64
1f852021aa767827db12999991ad10a4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetModuleFileNameA
GetModuleHandleExA
LoadLibraryA
GetProcAddress
ReadFile
SetFilePointer
CreateFileW
MultiByteToWideChar
GetLastError
CloseHandle
GetFileSize
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
FreeLibrary
GetModuleHandleW
LoadLibraryExA
LocalFree
FormatMessageA
FindClose
FindFirstFileExW
FindNextFileW
SetFilePointerEx
AreFileApisANSI
SetLastError
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
SetEvent
ResetEvent
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
Sleep
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
EncodePointer
GetCurrentThread
GetThreadTimes
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualFree
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
LoadLibraryW
RtlUnwindEx
RtlPcToFileHeader
GetCPInfo
ExitProcess
GetModuleHandleExW
GetConsoleMode
GetStdHandle
GetFileType
HeapFree
HeapAlloc
GetStringTypeW
LCMapStringW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
FlushFileBuffers
WriteFile
GetConsoleCP
SetStdHandle
HeapSize
HeapReAlloc
WriteConsoleW
Exports
Exports
GetAnalyzerInterfaceByType
GetAnalyzerTypes
GetConfiguratorInterfaceByType
Sections
.text Size: 229KB - Virtual size: 229KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 94KB - Virtual size: 94KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 21KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ