krnl_bootstrapper[.]exe | Triage

Sharing

General

Target

krnl_bootstrapper.exe
Size

1.1MB
MD5

e53d755df1fc28412cbab5b9d25b5c15
SHA1

b985dcbeaabd978eb3437cccd1522d5b5d9b4154
SHA256

c64f9d2d634e433782316d112ded8b8ba9faaba0bcb47d1e0ced3425140049d7
SHA512

f7e63bcd2e5ec432073c7b6f4e6a566c653c3d83312faee5afe92d710dec5df696dd3803ff3ebfe72f7a31f5a6513a619aa829118c84f4fccbac3c4c6a643014
SSDEEP

12288:bnBVCrK2jsP3zv+FSF68GANNhWLS0B6L+FOCN+AzrnxdanvzFzh:bBU7ecSgL6y+gk+rnxdarF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
krnl_bootstrapper.exe

Files

krnl_bootstrapper.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

E:\Archives\Documents\krnl_bootstrapper\obj\Release\net472\krnl_bootstrapper.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 920KB - Virtual size: 919KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 250KB - Virtual size: 250KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ