ElysianBootstrapper[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ElysianBootstrapper.exe
Size

17KB
MD5

c9fc044929e315cb51bad28c5b571dd0
SHA1

aedc9456f59133f85855d4715b245bb878161310
SHA256

1fabc119d4bc0889a7ae6e27a4c6b10ae492680aa8d20f5684e5b130adede6c3
SHA512

b657b6af15f9fa2adf5603eda8e37c6107cb1ef9a674c011816aa3e94f01dd41be5fac44d0ec4f2adc3dd6492e8fb72350919a8a947f8e2dabcdbf5f26256c4a
SSDEEP

192:RWw7XQ1A+CVSC0o8TdXdM9PsOCCoI7OjqP55OU5ZKV3nrsXVVBR7jhrY21:RWL1bCUZTdXGugoIvPyUceV/v

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ElysianBootstrapper.exe

Files

ElysianBootstrapper.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\briwo\source\repos\ElysianBootstrapper\ElysianBootstrapper\obj\Debug\ElysianBootstrapper.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ