boot[.]rar | Triage

Sharing

General

Target

boot.rar
Size

22.7MB
MD5

e12309706bacdb074c6c2aaa1d38580d
SHA1

4f5a57d473d7efe3245b7b436fc7dcf2d1052068
SHA256

b6f677ed348de7160677ca453846e77713ba1b2e9820b03be282956626725eca
SHA512

c24a432945121ca5d3e1998a7f057c9901d47f7a103051a0355fd51fd9935f42cb06d30f2515874d4c6aab4ed45f83c5d72cf67918ed958c3fccc623eba504d8
SSDEEP

393216:eC6jn5+ZFgEknm4G6eRzt6/+lRE0gLfZFrRa/5Fh4vj8EXWTqbshc8rJnTtyXbt:r6j46LnoTRBliBTvrRah8jhWTqVsTtgt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/boot/Output.exe

Files

boot.rar
.rar
boot/1.bat
boot/1.py
boot/2.bat
boot/2.py
boot/3.py
boot/FixBug.bat
boot/Output.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 19.1MB - Virtual size: 19.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
boot/database.txt
boot/fix bug.py
boot/gif.py
boot/one-piece.gif
.gif