File Name | uploaded_file |
Scanner Version | 1.0.136.174 |
Database Version | 2023-09-09 08:01:35 UTC |
Malware family: CobaltStrike
Hash Type | Value | Action |
---|---|---|
MD5 |
9929067b40365d4925c3059094b47f52
|
|
SHA1 |
20694574f70f82bc98468126955f53ee9387b915
|
|
SHA256 |
5336f0b78ccd4a2f4d0e3c9e31ca7aa5df748aa84a3496c660e9d6ee8fbe7317
|
|
SHA512 |
1101dc5a97519bec032b31ddd8246320cdd915e60b2ced35c557c44655ebae66ebf3edcf1de03266c45d938b19801b9e3c7d94d3524862ccb1d77effcfb5dc97
|
|
ImpHash |
8737e3b6db7ac37b7efe45e6204193ba
|
Image Base | 0x10000000 |
Entry Point | 0x10018d0d |
Compilation Time | 2023-02-16 10:28:34 |
Checksum | 0x00000000 (Actual: 0x000485ab) |
OS Version | 5.0 |
PEiD Signatures | No signatures detected |
Digital Signature | The PE file does not contain a certificate table. |
Imports |
4 libraries
KERNEL32, ADVAPI32, WININET, WS2_32 |
Exports | 1 functions |
Resources | 0 Resources |
Sections | 4 Sections |
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Characteristics | MD5 |
---|---|---|---|---|---|---|
.text |
0x00001000 |
162,229 bytes | 162,304 bytes | 6.67 (Compressed) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
BC4FDE702BB8603A38BAC596D771D126 |
.rdata |
0x00029000 |
39,953 bytes | 40,448 bytes | 6.64 (Compressed) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
3516895227359AD17D2EDC5893B85BBB |
.data |
0x00033000 |
61,472 bytes | 27,136 bytes | 2.48 (Normal) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
1BFEE4DEF43E33F70DDCC78A01AFFCD9 |
.reloc |
0x00043000 |
8,288 bytes | 8,704 bytes | 5.60 (Normal) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ
|
D552EFAF3D3AF5C7ADC7E2DBCC91E924 |
2 section(s) with elevated entropy (≥6.5) - possible compression
This file is not digitally signed.
⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources
The PE file does not contain a certificate table.
Recommendation: Verify the file source and ensure it comes from a trusted publisher.
Gridinsoft has the capability to identify and eliminate Trojan.Win32.CobaltStrike.bot without requiring further user intervention.
Download Anti-MalwareFollow these steps to completely remove the threat from your system