BootstrapperNew[.]exe | Triage

Sharing

General

Target

BootstrapperNew.exe
Size

2.9MB
MD5

a5da11e4a285848ae515180014f45b31
SHA1

a9a3831a17d602f2aa1c2adf91328a1b639efe51
SHA256

f3e50131ad394cee77a2f242e521a30662bbfb670a459e151fea8916ca0c9bfa
SHA512

8d6bd11c484f967a79a9a5f07ed2e2fc5fba768e963de87d772fe1702a643f775641422f5399fa8a94e0c6ccaadfc7c690620fb72dfffb7e62d31aabbfb8a8ec
SSDEEP

49152:8NRJ4Dffl1NvzVQi91k3oTiQ+j07CM3hJfUNeGU76VNHYYO6gpls53NMCHoX:iqDfHtzi41HTJ+j0OofUNW767zgplK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BootstrapperNew.exe

Files

BootstrapperNew.exe
.exe windows:10 windows x64 arch:x64

2409623c0893b151e9ad9a6038044e05

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

advapi32

FreeSid

gdi32

GetDeviceCaps

user32

GetDC

msvcrt

exit

comctl32

ord17

cabinet

ord20

version

VerQueryValueA

Sections

.MPRESS1
Size: 2.9MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE