Behavioral task
behavioral1
Sample
Bootstrapper V3.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Bootstrapper V3.exe
Resource
win10v2004-20240802-en
General
-
Target
Bootstrapper V3.exe
-
Size
17.8MB
-
MD5
bf0439cf42b00f04893b9070721a1f73
-
SHA1
e8164ad3761354657e82d4b65172632e877c77b6
-
SHA256
bc3807a11b22c80570bdffad0367fd7df3012bfca355cee2deaeaada812394d6
-
SHA512
3fbf71536d4650e9c1044e4237e8a5b61a52f00cb41307785268d7b99ace708b4076058c7ab81eebaa2a6391330658c58e1bc9f13e15fa2ed607bafef4dd1fdc
-
SSDEEP
393216:LUdSFy/WtxVcWNhQYKBGJGJm8whzRUxMgOpsLgEnmec7j8zTEgHJ8D0Az3/:LUEF+pWztJGzmzK9ysLgEC7j8z9K0AzP
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Bootstrapper V3.exe
Files
-
Bootstrapper V3.exe.exe windows:6 windows x64 arch:x64
9844b6546a7e9ce677ea84824c782db3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
shell32
SHFileOperationW
kernel32
SetLastError
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Sections
.text Size: - Virtual size: 127KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 147KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 15.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 17.3MB - Virtual size: 17.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 424KB - Virtual size: 423KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ