NylithBootstrapper[.]rar | Triage

Sharing

General

Target

NylithBootstrapper.rar
Size

239KB
MD5

a67e15aedb0a73d21e870b97706f87cc
SHA1

51bc2af8d6705ae6f59c9642a99410d2fa442856
SHA256

a537628fc0239ee5e022eb18eb2359c31e5e0a39ecc71b50b0b69003f53914ee
SHA512

997fcf27cc9c2d85f4aa163696876b1162ff23957e290a35950f22bd8a6d6e8291524c828ed6e83d6422d845f1e44a0c67d3cb936b6981d3bfb7054bc661a5a9
SSDEEP

6144:grcWEduyk9P8ZjdfNfOzpPT7t5o2XBCayCRMiO6u2a0/VIoEw/:JIy2P0d1+JLo6TMiOE/mb0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/NylithBootstrapper.exe

Files

NylithBootstrapper.rar
.rar
NylithBootstrapper.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 249KB - Virtual size: 249KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ