bootmgr[.]efi | Triage

Resubmissions

20-04-2023 09:11

230420-k5xzyagg56 1

20-04-2023 09:11

230420-k5pcssgg55 1

Sharing

Copy URL

Twitter E-mail

General

Target

bootmgr.efi
Size

1.4MB
MD5

147d7bbc85bfb5c2e5111e9b1deb200e
SHA1

fca73b1e6ea24382ff97b2b75d3238d9913b178d
SHA256

347fbd3d13380812f87bacd6e336e18e32480b9a1bf0e4c38a3764430c13dcd9
SHA512

66857eed19c399793e6ec1794cec88c6a63439f6873d8771d89aed842e2b46a44bb62d7d1859ac36ecaf90b4041ae7856087c5d59ba2621d4a2e9a63f3a5fe99
SSDEEP

24576:noIcL7rGhJBpv7y3C0BDc5KZ7YFW7paqnS7m9hRYHQIUy0WVu16Ju:oYv7yrfO47TSC9hSwyTY

Score

1^/10

Malware Config

Signatures

Files

bootmgr.efi
.exe windows x64

Code Sign

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03-07-2018 20:45

Not After

26-07-2019 20:45

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1c:9d:42:6c:f2:d0:95:89:d0:01:59:a2:c6:b8:77:85:be:03:e8:0d:73:29:06:6d:59:e1:ba:68:69:f2:47:ac
Signer

Actual PE Digest

1c:9d:42:6c:f2:d0:95:89:d0:01:59:a2:c6:b8:77:85:be:03:e8:0d:73:29:06:6d:59:e1:ba:68:69:f2:47:ac

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

13-04-2023 18:12
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

TRANSIT
Size: 512B - Virtual size: 29B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

Code Sign

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

1c:9d:42:6c:f2:d0:95:89:d0:01:59:a2:c6:b8:77:85:be:03:e8:0d:73:29:06:6d:59:e1:ba:68:69:f2:47:acSigner

Signature Validations

Verification

13-04-2023 18:12 Valid: false

Headers

File Characteristics

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

TRANSIT Size: 512B - Virtual size: 29B

.data Size: 3KB - Virtual size: 263KB

.pdata Size: 43KB - Virtual size: 43KB

.rsrc Size: 64KB - Virtual size: 64KB

.reloc Size: 3KB - Virtual size: 3KB

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

1c:9d:42:6c:f2:d0:95:89:d0:01:59:a2:c6:b8:77:85:be:03:e8:0d:73:29:06:6d:59:e1:ba:68:69:f2:47:ac
Signer

13-04-2023 18:12
Valid: false

.text
Size: 1.3MB - Virtual size: 1.3MB

TRANSIT
Size: 512B - Virtual size: 29B

.data
Size: 3KB - Virtual size: 263KB

.pdata
Size: 43KB - Virtual size: 43KB

.rsrc
Size: 64KB - Virtual size: 64KB

.reloc
Size: 3KB - Virtual size: 3KB