Static task
static1
Behavioral task
behavioral1
Sample
krnl_bootstrapper(1).exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
krnl_bootstrapper(1).exe
Resource
win10v2004-20220812-en
General
-
Target
krnl_bootstrapper(1).exe
-
Size
1.1MB
-
MD5
88a6615157fafbefea10e5207d54e292
-
SHA1
bc695c8b579e989cdcec11d5252aac5a3296cc23
-
SHA256
426a066a7c5ed3e91f9ab5aadb860e969fbf74689179e02fa3b3d5e5e36cbd6e
-
SHA512
8546938f656bf4c799071a3efaf8e49aaad0ddb899d1a524b66021b92e6cd71c186b7f6ba0b16ab36963b11223027083168be5496612ad2ef09dc4f1d0319118
-
SSDEEP
12288:/+BVCrK2jsP3zv+FSF68GANNhWLS0B6L+FOCN+AzrnxdanvzFzh:/uU7ecSgL6y+gk+rnxdarF
Malware Config
Signatures
Files
-
krnl_bootstrapper(1).exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 916KB - Virtual size: 916KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 250KB - Virtual size: 250KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ