bootcfg[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

bootcfg.exe
Size

95KB
MD5

ec92eda497062006dcfc1d200dfd8c97
SHA1

1ddfd9e8224e4ccf18c6f6dae69dd7d8655d6716
SHA256

3ae4009d8722649281c1f352cfd65186198fc6ee8fd62b436869789f8d06d348
SHA512

82e9a336bc5adef11914c04fb94589bf24ab0123757f502f854cec3578bf242e149714f0eb74961b9bfbc7a83d37a701546db4d4eb029694aa64ce9e70f0533b
SSDEEP

1536:XKHR/57Ggj0+HPJwQWifFLAAHV1eH1OCUUjgnO18JQy+u5sFa+I38s:MpNDB/JRAt1OCUUxe+UsFa+Ix

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bootcfg.exe

Files

bootcfg.exe
.exe windows x64

f3adcd04b0bf69589b2b3643d6cf3803

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_memicmp
fflush
__iob_func
_vsnwprintf
wcstok
_errno
wcstod
_commode
_fmode
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
exit
wcstol
wcstoul
_fileno
__set_app_type
__wgetmainargs
_amsg_exit
_get_osfhandle
fprintf
?terminate@@YAXXZ
_XcptFilter
wcsncpy_s
wcsrchr
_ltow
wcsstr
_wfopen
_itow
wcschr
fclose
_wchmod
memset

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

api-ms-win-core-privateprofile-l1-1-0

GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionW

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter

api-ms-win-core-registry-l2-1-0

RegConnectRegistryW

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrStrW
StrChrW
StrRChrW
StrStrIW
StrCmpNW
StrChrIW

api-ms-win-core-file-l1-1-0

ReadFile
GetFileSize
GetFileType
SetFileAttributesW
GetFileAttributesW
CreateFileW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapValidate
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapSetInformation

api-ms-win-core-privateprofile-l1-1-1

WritePrivateProfileSectionW

api-ms-win-core-string-l2-1-0

CharUpperW
CharLowerW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
ExitProcess
TerminateProcess
GetCurrentProcessId
GetCurrentProcess

api-ms-win-core-libraryloader-l1-2-0

LoadStringW
GetModuleFileNameW
GetModuleHandleW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetComputerNameExW
GetTickCount

mpr

WNetCancelConnection2W
WNetAddConnection2W
WNetGetLastErrorW

netapi32

NetServerGetInfo
NetApiBufferFree

ws2_32

WSAGetLastError
GetNameInfoW
WSAStartup
FreeAddrInfoW
WSACleanup
GetAddrInfoW

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW

api-ms-win-core-string-obsolete-l1-1-0

lstrlenA
lstrlenW

api-ms-win-core-localization-l1-2-0

SetThreadUILanguage
GetThreadLocale
FormatMessageW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

ntdll

RtlVerifyVersionInfo

api-ms-win-core-string-l1-1-0

CompareStringW
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-console-l1-1-0

SetConsoleMode
GetConsoleMode
WriteConsoleW
ReadConsoleW
GetConsoleOutputCP

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle

api-ms-win-core-localization-obsolete-l1-2-0

CompareStringA

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-security-base-l1-1-0

AllocateAndInitializeSid
CheckTokenMembership
FreeSid

sspicli

GetUserNameExW

api-ms-win-core-version-l1-1-0

GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW

Sections

.text
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f3adcd04b0bf69589b2b3643d6cf3803

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-registry-l1-1-0

api-ms-win-core-privateprofile-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-privateprofile-l1-1-1

api-ms-win-core-string-l2-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

mpr

netapi32

ws2_32

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-sysinfo-l1-2-0

ntdll

api-ms-win-core-string-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-security-base-l1-1-0

sspicli

api-ms-win-core-version-l1-1-0

Sections

.text Size: 77KB - Virtual size: 76KB

.rdata Size: 11KB - Virtual size: 11KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 32B

.text
Size: 77KB - Virtual size: 76KB

.rdata
Size: 11KB - Virtual size: 11KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 32B