g[.]zip | Triage

Sharing

General

Target

g.zip
Size

275KB
MD5

4aa84b977f43c60e15db36b88bd5cf8c
SHA1

acc103e4a965e756fefa0101e9285c1234b52212
SHA256

94c72001593a77d1213854b7f2ea4db70b91b16b91d92045ff6c84692cd9d57c
SHA512

7f9462e6c9ded44b7e9788a20c5845be81ad113440910b85149810d0878889ce7fafdd3e6b99c8554d2c2ee2693d893b73bb2442428694d549bc246e5ec51044
SSDEEP

6144:VLeCvE9HWATfiTOys52lG6RcRPsaTxsA4nDy6TxrqrHsK+BBWsUD:VLeCvPA7MU/P8Dy6teQrWFD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/g/Bootstrapper.exe

Files

g.zip
.zip
g/Bootstrapper.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\Ashtin\Desktop\WTF\SolaraBootstrapper\SolaraBootstrapper\bin\Release\Bootstrapper.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 793KB - Virtual size: 792KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ