CookieSentinel[.]exe

General

Target
CookieSentinel.exe
Size 80.2MB
Sample260816-e4sqyabc28
SHA256 19fd8d2a1d4eb4761553c6ea75320b09f5085e33c5d3702ef9a3d6aff7abbe4a
MD5 a8c3008e9514a1add0a6e35e2a5f03bb
SHA1 cae75e6477f5c81efa7cc1b0da074e55c011f9c2
SHA512 81f607c86aa319a0d7b9d7a9984b86d177e4878c845a78065bf4875ffaa80ced6cc1c108ddc5bbe02f4642f9f3953f210699cf7d20b2d1a6e8747795cd154917
SSDEEP 1572864:vLDkoDCbaz6Ex9lA51UHAs7FcV4cM4BTUmcuL2Gv6B07FyK2r:vLDkoDcieGgsBo5CH8GgpK
TLSH
T18D0833F852445A6EE2E15236FA2E02B0D6B0BA25A8C7C6FAED9743C5CD33345853DF14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CookieSentinel.exe

File Explorer

CookieSentinel.exe

.exe 80.2MB

CookieSentinel.exe

IMPHASH 6b46d14e506e96f6104eaca4ffd6f8c4
SHA256 19fd8d2a1d4eb4761553c6ea75320b09f5085e33c5d3702ef9a3d6aff7abbe4a
MD5 a8c3008e9514a1add0a6e35e2a5f03bb
SHA1 cae75e6477f5c81efa7cc1b0da074e55c011f9c2
SHA512 81f607c86aa319a0d7b9d7a9984b86d177e4878c845a78065bf4875ffaa80ced6cc1c108ddc5bbe02f4642f9f3953f210699cf7d20b2d1a6e8747795cd154917
SSDEEP 1572864:vLDkoDCbaz6Ex9lA51UHAs7FcV4cM4BTUmcuL2Gv6B07FyK2r:vLDkoDcieGgsBo5CH8GgpK
TLSH
T18D0833F852445A6EE2E15236FA2E02B0D6B0BA25A8C7C6FAED9743C5CD33345853DF14
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

5896

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

ShellExecuteExW

kernel32

FreeLibrary WriteConsoleW GetCurrentDirectoryW CreateFileW SetFileAttributesW WriteFile GetTempPathW CloseHandle HeapAlloc HeapFree GetProcessHeap LoadResource LockResource SizeofResource FindResourceW lstrcpyW lstrcatW lstrlenW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetProcAddress LoadLibraryExW RaiseException GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW LCMapStringW HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx

Name

.text

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

80.1MB

Virtual Size

80.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

CookieSentinel.exe

shell32

kernel32

generic