Bootstrapper[.]exe | Triage

Sharing

General

Target

Bootstrapper.exe
Size

339KB
MD5

fa69bf7d10c3b170e62a858ed37dae86
SHA1

8dd6f73f10ea074e7c0885efbc0656adbaf22164
SHA256

97804a112500c22565e2c53d0f57db2a39210c08d2cfaab294294ebf268cc374
SHA512

5f5c8324d9c2e937fd7ed7f9a11706bc23f0f62362d47c97b8836a1f71d4ac0f938153a271f2e077330dccea1206582563291de748d61d1a806d959129468275
SSDEEP

6144:PgKasiALqxCcuUdsuAWoXhslQonB6x90cy83A/pHPNMibcWhRNTkM5Sp:WJCcfTAxsl9+91A/1yEhRRkp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Bootstrapper.exe

Files

Bootstrapper.exe
.exe windows:4 windows x86 arch:x86

Password: 1234

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.iat
Size: 329KB - Virtual size: 329KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE