WiNToBootic_v2[.]2[.]1[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

WiNToBootic_v2.2.1.zip
Size

873KB
MD5

10bedb7fa2e2887e428dd91c54aa9bde
SHA1

3075470ab3c92f86770fc76a4ae52912ce6e4c63
SHA256

6285da6101592b2f7dff94e8521885d26a685f4285ee6e643ed9c2c0bf26e0ac
SHA512

d13da6d8b99290de1838fe5894c5c81dee6e1ec0b6df0be4d682ad90d9eb6d1d9468b821a1c72b042c0ae34fdc6de53114790f9fab4004204b61a672a96ff459
SSDEEP

12288:6J3Lery4KBpNwiirLdXI7tHqAhN+tlMFsTcLzvnloa79I11vh6jkbBCP7gjG5Z:cbeM4rF2tX+t3Gns11EjkOsYZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/WiNToBootic.exe

Files

WiNToBootic_v2.2.1.zip
.zip
WiNToBootic.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.rsrc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 1001KB - Virtual size: 1001KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
v2.2.1_release_info.txt