c:\jenkins\workspace\8-2-build-windows-x64-cygwin-sans-NAS\jdk8u401\683\build\windows-x64\deploy\jre-image\bin\javaws.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2025-07-04_da7a1033ad53107dabf87d2e3acbbe3c_black-basta_cobalt-strike_satacom_vidar.exe
Resource
win10v2004-20250619-en
General
-
Target
2025-07-04_da7a1033ad53107dabf87d2e3acbbe3c_black-basta_cobalt-strike_satacom_vidar
-
Size
1020KB
-
MD5
da7a1033ad53107dabf87d2e3acbbe3c
-
SHA1
768fb673183f987cebabbb43255f50b0c8db8ab1
-
SHA256
b11725a9ee2bb3c5710551f5421918a57b953ceb683c17c2717d315d2bee2b7f
-
SHA512
7330afd9fea22dc63a1f9b27b9dfdf79d9373f73901a7574be66b50375f375a28e78ff0ff2ef5f77bb9735d9370876c58f42ccaeab49c7d130b6ffe7a8c5913a
-
SSDEEP
24576:utsdlChptx7FYA25SSiVw6uAX8DS52tpz9ZRzbPmSZyo:asdlChLxWT5SW6H8DS52tdDpbRZy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-07-04_da7a1033ad53107dabf87d2e3acbbe3c_black-basta_cobalt-strike_satacom_vidar
Files
-
2025-07-04_da7a1033ad53107dabf87d2e3acbbe3c_black-basta_cobalt-strike_satacom_vidar.exe windows:6 windows x64 arch:x64
21dd6543e57de3117875fbe5eecdd067
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
GetCurrentProcessId
WideCharToMultiByte
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryW
CreateDirectoryW
FindClose
FindFirstFileW
CloseHandle
WaitForSingleObject
CreateEventW
OpenProcess
GetTickCount
GetSystemWindowsDirectoryW
GetModuleFileNameW
GetThreadLocale
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
VerSetConditionMask
GetEnvironmentVariableW
CreateFileW
GetLongPathNameW
GetShortPathNameW
GetTempPathW
RaiseException
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetCurrentProcess
CreateProcessW
GlobalMemoryStatusEx
GetLocalTime
GetSystemDirectoryW
GetWindowsDirectoryW
GetVersionExW
GetNativeSystemInfo
GlobalAlloc
GlobalFree
LocalAlloc
LocalFree
FormatMessageW
lstrlenW
VerifyVersionInfoW
WTSGetActiveConsoleSessionId
OutputDebugStringW
GetCurrentThreadId
GetExitCodeProcess
GetModuleHandleExW
GetFileAttributesW
GetFullPathNameW
GetCurrentDirectoryW
SetEnvironmentVariableW
HeapAlloc
HeapFree
WriteConsoleW
HeapSize
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetFileSizeEx
GetFileAttributesExW
GetDateFormatW
GetStringTypeW
WriteFile
SetFilePointerEx
ReadConsoleW
ReadFile
SetEndOfFile
HeapReAlloc
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetStdHandle
GetTimeFormatW
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
RtlUnwindEx
RtlPcToFileHeader
RtlUnwind
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitProcess
GetCommandLineA
GetCommandLineW
DeleteFileW
GetTimeZoneInformation
user32
DispatchMessageW
DefWindowProcW
RegisterClassW
CreateWindowExW
SetTimer
LoadCursorW
wsprintfW
OpenInputDesktop
CloseDesktop
GetShellWindow
GetWindowThreadProcessId
GetMessageW
TranslateMessage
MessageBoxW
ole32
StringFromCLSID
CoTaskMemFree
oleaut32
SysAllocStringByteLen
SysStringLen
SysAllocString
VariantClear
SysFreeString
wsock32
WSAGetLastError
recv
accept
bind
connect
getsockname
htons
ioctlsocket
listen
ntohs
send
socket
closesocket
WSAStartup
WSAAsyncSelect
Sections
.text Size: 268KB - Virtual size: 267KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 104KB - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 33KB - Virtual size: 122KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 568KB - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE