0

I have a file (dll) that is a Cobalt Strike dropper based on the strings found inside. The file has an "entry0", and other general windows specific functions. The file appears to be encrypted in a way that allows it to produce a "legitimate" disassembly, however, a non-functioning assembly. I am under the impression so far that another file is required to "decrypt" the file into an executable state. Any advice, resources, and/or answers are greatly appreciated.

Yara searchable string: AWAVAUATVWUSH

md5 4c1bf9b4b6cff0e67eb43e0607106256

sha1 2ef021cb3a809a36786ddfb026473ce751f93c56

sha256 4a768074cc312aa3554eca66e4489787b97282c0732f3d5ead85ef4e9bdbfa93

First 11 Functions

0x140041a60 1 116 entry0

0x140019168 8 107 -> 82 sym.WINMM.dll_Ordinal_1

0x140039f0c 22 1453 -> 1449 sym.WINMM.dll_mciExecute

0x14003425c 1 26 sym.WINMM.dll_CloseDriver

0x1400097b4 2 26 -> 17 sym.WINMM.dll_DefDriverProc

0x14000977c 1 16 sym.WINMM.dll_DriverCallback

0x140026bf0 1 1 sym.WINMM.dll_DrvGetModuleHandle

0x140025e4c 15 293 -> 120 sym.WINMM.dll_GetDriverModuleHandle

0x14001d1a0 1 12 sym.WINMM.dll_OpenDriver

0x14003ba1c 10 1226 -> 990 sym.WINMM.dll_PlaySoundA

0x14003f360 39 4330 fcn.14003f360

File Information

arch x86

baddr 0x140000000

binsz 1142784

bintype pe

bits 64

canary false

retguard false

class PE32+

cmp.csum 0x001180e7

compiled Thu Feb 13 16:30:33 2020

crypto false

endian little

havecode true

hdr.csum 0x3f88a0a3

laddr 0x0

lang c

linenum false

lsyms false

machine AMD 64

maxopsz 16

minopsz 1

nx true

os windows

overlay false

pcalign 0

pic true

relocs false

signed false

sanitiz false

static false

stripped false

subsys Windows CUI

va true

1
  • 1
    Welcome to Reverse Engineering! Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help to clarify this question.
    – MarianD
    Nov 28 '21 at 21:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.