D:\PCGMR_BUILD\Cim\CiSrc\pdfconverter\pdfconverter\product\win32\PdfEditMenu.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2025-05-14_1652d7c80952a9ac54d59d4d2aedc182_black-basta_cobalt-strike_hijackloader_satacom.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
2025-05-14_1652d7c80952a9ac54d59d4d2aedc182_black-basta_cobalt-strike_hijackloader_satacom.exe
Resource
win11-20250502-en
General
-
Target
2025-05-14_1652d7c80952a9ac54d59d4d2aedc182_black-basta_cobalt-strike_hijackloader_satacom
-
Size
349KB
-
MD5
1652d7c80952a9ac54d59d4d2aedc182
-
SHA1
d0b51c295395913f836de488cded592a25383f58
-
SHA256
1980e370c276b65321018e736e20bc73d40090894d60bca4e428474cb13862ab
-
SHA512
e65f1709faeb9445ce30f1e8e0b48f3fde2a7b52165dee0930b27512bc05502dc8a18c4566af6786a4fc66ae08a3646b997daf8fff9672c2502043c1a754d2d6
-
SSDEEP
6144:meGJSOoWzzmlPls4SUzT5FDhCohCVBwB9:mX1oW36eETYoMBwB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-05-14_1652d7c80952a9ac54d59d4d2aedc182_black-basta_cobalt-strike_hijackloader_satacom
Files
-
2025-05-14_1652d7c80952a9ac54d59d4d2aedc182_black-basta_cobalt-strike_hijackloader_satacom.exe windows:6 windows x64 arch:x64
84691d90078a4ed47a0ed5732cf4d8b2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapSize
HeapAlloc
HeapFree
HeapDestroy
HeapReAlloc
api-ms-win-core-version-l1-1-0
VerQueryValueW
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
ResetEvent
ReleaseSemaphore
CreateEventW
SetEvent
DeleteCriticalSection
CreateSemaphoreExW
ReleaseMutex
WaitForSingleObjectEx
WaitForSingleObject
CreateMutexExW
OpenSemaphoreW
api-ms-win-core-sysinfo-l1-1-0
GetVersionExW
GetSystemTimeAsFileTime
GetSystemDirectoryW
api-ms-win-core-errorhandling-l1-1-0
SetLastError
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-version-l1-1-1
GetFileVersionInfoW
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
GetModuleFileNameW
FreeLibrary
GetProcAddress
GetModuleHandleW
LoadResource
FreeLibraryAndExitThread
GetModuleHandleExW
GetModuleFileNameA
FindResourceExW
SizeofResource
LockResource
api-ms-win-core-libraryloader-l1-2-1
FindResourceW
LoadLibraryW
api-ms-win-core-file-l1-1-0
FindClose
CreateDirectoryW
GetFileSizeEx
GetFileAttributesW
GetFileType
WriteFile
FindFirstFileExW
SetFilePointerEx
ReadFile
CreateFileW
FlushFileBuffers
FindNextFileW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-processenvironment-l1-1-0
GetStdHandle
SetStdHandle
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetCommandLineW
SetEnvironmentVariableW
api-ms-win-core-processthreads-l1-1-0
TlsFree
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetStartupInfoW
TlsSetValue
CreateThread
GetCurrentProcessId
ExitThread
ExitProcess
TlsGetValue
TlsAlloc
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-localization-l1-2-0
IsValidCodePage
GetACP
GetUserDefaultLCID
LCMapStringW
GetLocaleInfoW
GetCPInfo
FormatMessageW
EnumSystemLocalesW
IsValidLocale
GetOEMCP
LCMapStringEx
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-privateprofile-l1-1-0
WritePrivateProfileStringW
GetPrivateProfileStringW
api-ms-win-core-com-l1-1-0
CoIncrementMTAUsage
CoTaskMemFree
CoCreateFreeThreadedMarshaler
shell32
ShellExecuteExW
SHGetKnownFolderPath
shlwapi
PathFileExistsW
version
GetFileVersionInfoSizeW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
GetStringTypeW
MultiByteToWideChar
CompareStringW
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlUnwindEx
RtlPcToFileHeader
RtlUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedPushEntrySList
api-ms-win-core-console-l1-1-0
WriteConsoleW
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
oleaut32
SysFreeString
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateStringReference
api-ms-win-core-winrt-error-l1-1-0
GetRestrictedErrorInfo
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
Sections
.text Size: 215KB - Virtual size: 214KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 91KB - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.zero Size: 8KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ