Behavioral task
behavioral1
Sample
ab75d7a7379448c8b16e3731aec2f4b8a09cfc2e4bf051ef6e1e6e00bfcfedb4N.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ab75d7a7379448c8b16e3731aec2f4b8a09cfc2e4bf051ef6e1e6e00bfcfedb4N.dll
Resource
win10v2004-20240802-en
General
-
Target
ab75d7a7379448c8b16e3731aec2f4b8a09cfc2e4bf051ef6e1e6e00bfcfedb4N
-
Size
206KB
-
MD5
93ef305942c20516537edc65ff225200
-
SHA1
8f8fadf23ba17a9b872dcf8fb453f681769d2254
-
SHA256
ab75d7a7379448c8b16e3731aec2f4b8a09cfc2e4bf051ef6e1e6e00bfcfedb4
-
SHA512
52a46033f305e5162e33d10dd9ca51da675562223336a660f6b4035a499299bf3522ddc0ce09c0a2cf8956ac7512021ccf7e4f6cd2dea7b4cb94bf40f1dfbf8b
-
SSDEEP
3072:uSCNgSvXuej6RSp71nMv8C3DwRakOkt8a13FGwYwdPit5jlU2m5e7:us8Xu06891Mv8CziaXSl1HdPgj
Malware Config
Extracted
cobaltstrike
0
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 1 IoCs
Detects the reflective loader used by Cobalt Strike.
resource yara_rule sample cobalt_reflective_dll -
Cobaltstrike family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ab75d7a7379448c8b16e3731aec2f4b8a09cfc2e4bf051ef6e1e6e00bfcfedb4N
Files
-
ab75d7a7379448c8b16e3731aec2f4b8a09cfc2e4bf051ef6e1e6e00bfcfedb4N.dll windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Sections
.text Size: 149KB - Virtual size: 148KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ