bootmgfw[.]efi | Triage

Sharing

General

Target

bootmgfw.efi
Size

534KB
MD5

65b0e03de38184a22b909868e76d0fc8
SHA1

7903a674a379e6f6b4b20d9cf1f107b95752e88e
SHA256

268f22823e1f659702cb940da7c0cff5bd84bece60bee9495c11d68fe5e2f157
SHA512

bc1a0c59ddac9855c93b7aa99f40808a95bd4a34085f578cd247150fafc0a9e3f20cc15f1143f10303e2c59898f8e0ca7b5f45afec1b5c8b22aded8326c468dc
SSDEEP

12288:KtAHgyxzsqttPeYoZ5bJbLB0NBTq+ilfdYC+/NKkC6zAk:KtAAAttWpbxkine

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bootmgfw.efi

Files

bootmgfw.efi
.dll windows:0 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

___________________________________________________________x64\Release\UefiBootLoader.pdb

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 519KB - Virtual size: 519KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 480B - Virtual size: 456B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 448B - Virtual size: 428B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 128B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ