Bootstrapper[.]exe

Bootstrapper.exe

IMPHASH bf95d1fc1d10de18b32654b123ad5e1f
SHA256 1bf8fbfc44c5875285af1653fe8e2ce6ee4bc90bdbf732df92adef21bf1f493b
MD5 5f6445d04a2b17ce1c974b4a47bde804
SHA1 76a986fac07f3ae5e2255740705f56ed9826d026
SHA512 dc10cae7f25cd8ff9ad9ba3c51b9c86779eb8ba6e6a1060d81aa0295861b0f9dad82c39958005696e44d08139041889c35a3da9b2a1ef338339f54763d830285
SSDEEP 24576:R0ags6DNvYGwLroJQ8fSVnPy6KonM4Yhes9OW/PABYpO:RCpaiN6a6KkRY9AWk
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

b7:b3:f8:3f:4f:f6:9e:40:0d:39:09:07:26:47:55:03:e9:ef:20:ee:06:5d:d0:ac:d7:0d:1f:f9:fc:01:8d:4e

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Dropbox\, Inc,O=Dropbox\, Inc,L=San Francisco,ST=California,C=US

Chains

May 26, 2025

CN=Dropbox\, Inc,O=Dropbox\, Inc,L=San Francisco,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Dropbox\, Inc,O=Dropbox\, Inc,L=San Francisco,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=Dropbox\, Inc,O=Dropbox\, Inc,L=San Francisco,ST=California,C=US

Serial Number

03:8a:4a:4c:4d:aa:6a:ad:4c:64:bc:63:bf:08:2c:4d

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 25, 2024 - Feb 13, 2026

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Dummy certificate

Serial Number

01

Issuer

CN=Dummy issuer

Timespan

Jan 1, 2013 - Apr 1, 2013

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

5

Entry point

13289

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte MulDiv lstrlenA WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx FindWindowExW GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint IsWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$TEMP/Achieved.aifc

SHA256 7b32032851f62ab976532d137c8532cadac600500a6b1cbf44eb88e1bee1a4db
MD5 52b83513d63c81490a2d531eec62e7b8
SHA1 2a63737a023734ba51acaa3ac6972527d6534f6e
SHA512 a441cc272efbf1f98757ffac9dab75abf0792dc416c6db0b1594596fbf273c2f4d05ce12cbcd3a1a320cd970db8604f4ebb213f76bada3e013eb93b55c397846
SSDEEP 1536:PVfMNzETIjFr/U5D89QQApOhYHlr9VViCsGxvYsv:PhMVETIjGt8QVfviCssv1v
MD5 SHA1 SHA512 SSDEEP

$TEMP/Belfast.aifc

SHA256 c6bee0e758426abd130841883157554c3a3104accad72be7c24d01de57e2f58d
MD5 125bcfef56bf9543128257355c012e83
SHA1 124bbff81896e9322fe1ca4a02daf1f4b999c666
SHA512 01fd7cd5aac991218b2a15954ac889e066576c16ba1d01b49f8ec94d8fe5a8a689ca4d0fbb9dbac7c0f6a07a9957485a267174798e102cdbc9834944232597fb
SSDEEP 12288:RmsFZ6Gh2i2REg3OlTg4iMebfFAvmAXP1mqtk:Rmsr6Ni2RpUNqbfFAuGP1mH
MD5 SHA1 SHA512 SSDEEP

Analyze

SHA256 740b5660932e459c88f76d8fc3098645ab8be5bae6e896c529025dbe3f4627aa
MD5 afc8ae0d857416580905d7c05ff0e441
SHA1 a31d9f14cc85965baa8f14a999ebdc2ea9584023
SHA512 1688857f8286265a7bf290b4e3d951285b79693fd9651bccbd275036e83a95b272c9bd2744513f99b705ce7516f10e14ad54465ace47b521e2c2602aaf3ec58d
MD5 SHA1 SHA512

Artwork

SHA256 6b1a59a50443ee93087a4337c3c2a8ebf1ae4b738799ca20da659fa8e17bfb15
MD5 ce8f747ea545f4eaf081bd1f61e09270
SHA1 4622ba12a11e5924f82965330aec213413f23e23
SHA512 0acade83c699606abd0f7cc73d7113cf0426ebe21087a70080e6260bca70c45b93d5b38aa0056a1fa3cdc57b5576336299f3e2800cfc0085ffecc878031c3db1
SSDEEP 3072:wwS2u5hVOoQ7t8T6pUkBJR8CThpmESv+AqVnBypIbX:wb2j6AUkB0CThp6vmVnz
MD5 SHA1 SHA512 SSDEEP

Dining

SHA256 ade5bf5f4d08bf99160a27a6f15434310421a7109f39db021c2b0097f1ae506a
MD5 c3811420957bc9028618410d80ebf6a1
SHA1 4b2e293f5c44224575a9244cfa21a0af6fec7603
SHA512 3afe70f0c33a192961679170732cce4e65ed14ecffb573620b41549ebcdacba3021993e22407edfabb76aad26e38e56e867049cd248892deba0d67bd5f003a64
SSDEEP 384:Wu88888888888888888888888888888zv888888NfU84444Qnoooooooooooooot:W/SGg
MD5 SHA1 SHA512 SSDEEP

Dust

SHA256 482b13a513a7e8b3a24727e61d120d75a5b1d00378046a7d9f89c290d75a378c
MD5 b1734eca86fc64e40abdb9068763e5dc
SHA1 a4cfc554e5ba551d91c4363aeb468433811b26f6
SHA512 e97d65c422f1b5dc9778a1846278bd84849037c163af291e32a7be285b8c2c3c351bfd645b3ac52a28f2be1184e2408d0da40386563feb87fe4afaad1c57e064
SSDEEP 3072:O6whxjgarB/5elDWy4ZNoGmROL7F1G7ho2kOy:O6ggarZ8aBZ2GmRq76to
MD5 SHA1 SHA512 SSDEEP

Implementation

SHA256 280ce092313b7ee5821a138b4a0f9ee2f53710eab30b96c669d0d7ac8b14ba5e
MD5 d4140d032ea587dc4e2687482faf7bb5
SHA1 d90da8d289d2000e9673a3258e5c3ed2dd5a314c
SHA512 fa7321342d3e1e6b685a38ccc173318d6b2a91b26b3038b82aa1f8ba8b636a6b1c08a76549d7b0e2439d6bbee90f89b119b7841b3ff686e9fd490e9c8f400d15
SSDEEP 1536:E1/AD1EsdzVXnP94SGGLpRB6M28eFvMVT:EZg5PXPeiR6MKk1
MD5 SHA1 SHA512 SSDEEP

Perry

SHA256 dc1c92f7a729305f27a35005c4d7e85d53b5a83a60f301ae8ef0112a4e11c029
MD5 3a6a85bbddef219aa30503e64cf3c10c
SHA1 e474e5bc680c58af8a77ba14e054e1b17e732add
SHA512 ecab17ff0514e8d6ca9f62b4876cdfa06d3d7e9302bf817cf637216808473d17140ce056fa0efd519c5aed8157df04524a2831e61f47c482722e7b04afc558cd
MD5 SHA1 SHA512

Personalized

SHA256 615cff454608a644f6878e4946c05664cdc8fbc95c943570a0ca80e1c020c84b
MD5 f3541ef6aba32e56f85dccf3cf6dc6ea
SHA1 736c707b79361d4e679f677c8e59aa482ca41fc5
SHA512 e1925f7eaf3c243b5b80258bba1a6ac9a956b68085fedc4717bfde627321b8d39dba384a1897bbe55d044f5c6ee5c1268c938c529afcaf6c971b49f79d6f8ee1
SSDEEP 3072:T0Imbi80PtCZEMnVIPPBxT/sZydTmRxlHS3NxrHH:WbfSCOMVIPPL/sZ7HS3zz
MD5 SHA1 SHA512 SSDEEP

Reach

SHA256 f1e64e57dde435027c491e2610c246688d1a8ba7e73f8af3548724ad3cfe037e
MD5 390c7434f9ac638621af21a1839f49cf
SHA1 3131ffd6df0752df888822b70bedd32f7b4a9755
SHA512 387b33a3347b559adffed36591b929cc5bbd3f3ce6a21ff6861452c85fa4021c54c90cc6c8886d12b7a1dc97c7563ed9225939152b1ea8baaf66d19aaa1919b2
SSDEEP 1536:kG/UXT6TvY464qvI932eOypvcLSDOSpZ+Sh+I+FrbCyI7P4Cxi1:HgF4qv+32eOyKODOSpQSAU4C8
MD5 SHA1 SHA512 SSDEEP

Richardson

SHA256 1ae5a342203cf1103a5cb7613df9af4ef98a9ea9f95b5922bf3d75e220a2d30c
MD5 39b70f112395a2449f7a4e50954a097d
SHA1 fe49c34a91c620710a849d41ba433ceaba202432
SHA512 73641a968848c126bedc27fa6db82431bc59f26bb75dc5ebb67a90ca941265fd8342e1f077900c1f871cf405de31025d2c6299fc3aa08dd3fee5c380ed05f0db
SSDEEP 1536:yJ3RraSXL21rKoUn9r5C03Eq30BcrTrhCX4aVmoU:yBRtNPnj0nEoXnm/
MD5 SHA1 SHA512 SSDEEP

Supplies

SHA256 54e1d5965879216e29d333c733c4a3ce3bb9d5db6113397c2fc0203159595931
MD5 66a2dbf3cd7e61f99e90630d882c894a
SHA1 91d3b9b18ffbf33c312d0ff5ccf01176f684eb34
SHA512 b55877201159907e95f8e7d093632b3fd169824ed87b077774764f1ef1adcc3e1b0a3e6f78811a09c16b742b02eb4904e53264a28d4208f000801674d5dff32b
SSDEEP 1536:NYhWoXElJUzdlDfFgQa8BpDzdZPp7HE+tKA3QkvyNf7Xw2U0pkzUWBh2zGc/xv5q:NGWoUlJUPdgQa8Bp/LxyA3laW2UDQWfF
MD5 SHA1 SHA512 SSDEEP

Thanks

SHA256 94a691697614e49bf4c5ecdf6aec77a491497ae55510af92c774af936e44503c
MD5 75700ee95fda8ad3815d05033d1c1a2b
SHA1 e64074bc0ad15aff0959c3dbab0f293d1f24f6d0
SHA512 af925233c9842a4116800b99a8053c5ecff23a2e30b13b838e07a3784b53ac8032a5353d43985396dea30214f6662e4ef86971ccdb1cd52ce639c5470b41f186
SSDEEP 3072:f18mLthfhnueoMmOqDoioO5bLezW9FfTut/Dde6u640ewy4Za9coRC2jfTq8QLh:fphfhnvO5bLezWWt/Dd314V14ZgP0J9
MD5 SHA1 SHA512 SSDEEP

Timothy

SHA256 63149b7ca025c3c999e9919dd78b01e8860567fac4be7a9acf44a636201054fa
MD5 79bbd59acdc28d749d092a41ff2d9acf
SHA1 10f8d7fdf74e1f84434b431716b1d09c0fb0d6ca
SHA512 c05de9b6f5333fcdd4fcae3d5a87a95d5f6006904ea6d0181b3e0878ce51a7abc9e058171e661e01a77c40b7fc6b1de7ce6fa76e41e89c1f9941bc403bbc50e3
SSDEEP 768:Wvq6LqgaHbdMNkNDUzSLKPDvFQC7Vkr5M4INduPbOU7aI4kCD9vmPukxhSaAwuXt:WvtmgMbFuz08QuklMBNIimuzaAwusPu
MD5 SHA1 SHA512 SSDEEP

$TEMP/Central.aifc

SHA256 9bc0cc61ad709051693a2be40e62c3b7c7a14ca9f041056fe9db03f182061076
MD5 cb63e750359d68aac8367cc564363fa7
SHA1 8919534a767c3edcd060b765d5c9c70ee3308c76
SHA512 ea215864638e40a7acfbe28c589513a052762db16220af5e4aab5ce180945866e2961b4d477d37d40a2ca99c86f38360f37b1bd906bdb74d6254871617d34bcc
SSDEEP 384:OafnVbny3w2z78mdtpA5yTc244tpO0nmwUnSB+oAdS4g:NnVbnB2z78mjptc2oKUSBHAMx
MD5 SHA1 SHA512 SSDEEP

$TEMP/Customize.aifc

SHA256 315f27d308303c1271e9874b96a619dfc2db29ead55e6fbc453baccf7e541e5d
MD5 dae417dc73e65c08040702f0346908f3
SHA1 67a3596c54f27cd1f8357697fdc815b6dea88559
SHA512 a54cb470c19c0aeec0b51f07bc41274ef6df28a7ba15c70d49eeeb38b8a362ea832000e9614e39bc468f8e0b6e7038460015d2adf8327b1a1748ae4bb6c9560a
SSDEEP 1536:U3gYFsSef4HJgNsMRPBPybV4NAoKAMwwI0jOaL:s1sSef6gNs8EbVloKAEI0nL
MD5 SHA1 SHA512 SSDEEP

$TEMP/Dave.aifc

SHA256 81870499c10a6b97aef9999e0cc6e6ba617025ec2c1e49783c5d39ee05b4ff79
MD5 109a24d7210899c46911afbc2072e67e
SHA1 371acd4618d054e12dad1f8e2209484f86966f21
SHA512 033a43e81665ca4527299fd698675a58a004405afb2deefc9e571de4a632ea1e9da7d3f7702af601fc65187b56c8b0845fbbf5627b06286f020036653e905aba
SSDEEP 768:v7jrpSQ8EF644qgPbfKDHV7rBJ5IAjpuhuZtQXPzVoMUIYUpZKKqPOSftHwTkfzr:zcEFIbIptT1uhea/zyDUTn+lFHwYt1/
MD5 SHA1 SHA512 SSDEEP

$TEMP/Mac.aifc

SHA256 bc0f04a2e51f4363e59aa646bb781efd7ddaf1427976dbef11cf98001ef36d72
MD5 3d076546f903b8b17ce91155d48322a4
SHA1 7df0df10c8da3690bbd2a74f694281d490d77bd2
SHA512 a121d775b73724c5159392aa1d5af49f46bf1897dcfe436164e81d0de243fd8bef890e2b6fd74a3519813e910294f185fff8e463309d974758cd89ebe0c84869
SSDEEP 768:BN4Dx8jiKa8alBO17gArdhH+3Go3AgzY/ZAXF1klA:BNAx6EBO17Dx+3B3pcSV6A
MD5 SHA1 SHA512 SSDEEP

$TEMP/Minolta.aifc

SHA256 7e3353db9e649dd7d8bb115c41ecfae63cdc4793b4aac4b9ef4ff5db35b20290
MD5 ec1ae56e58475b011a61d59323a04b22
SHA1 55ba53fd57c38e95e9fa875ab1ea166e902d75b3
SHA512 cb3a7d3e3fe0a2289649ce01b6fa1ee0234de4ffe245000e5da4ee946745ff50148b50fca96182a4c69d4f5076496aa39e35a9b846dfa683aded6f2b41666c5d
SSDEEP 1536:XkcIszSyTP7FW5pnkAERFCDPxx//nsxeuLR23bjzJkZVwP1NZKwz:XAszS2TFoSFSxmfL/3ovZNz
MD5 SHA1 SHA512 SSDEEP

$TEMP/Pe.aifc

SHA256 9589c2bf0a6560b6e88f6ca0d179d146b65516b1fe292f549d57a9a18b970f4c
MD5 2272d73e83671cd8fcfec4ab00367d2a
SHA1 57f3cc8ec691a6bc9de7b2c36467ad8a969a3448
SHA512 37397c9e0ce8b17e7318381157bfa750175e0f720502e4183b0354237e8706a0c1fb6dbeb3a2e3af7a1dfcfc465d2faf676187cf83ecf164f8c5a18418a073a2
SSDEEP 1536:IOV5HZ7ANuxDPiZHK9lQrqtCWxUPrYFhx63i4P/Jj25PqxVC8:t3HFrxD6x6lQrqJxUPEFwi43JjYPs
MD5 SHA1 SHA512 SSDEEP

$TEMP/Significantly.aifc

SHA256 50d6b62a45039bf9642b597e0c63e1430ff383e29cab8b17f26d4e156468a3e4
MD5 5d4e2f8c943143ed2e8770798fbc66e4
SHA1 e9a0a2ce7e2a2944eeeb4316bd450fa8643bdde5
SHA512 72f68de801c00495cbe1084cee12cc2fa48edabba2ca71b357b92d167d3e1bc96f5f13d830a7f95677a5109015b0a080469df37d0ab3b0948d62e6b8fcf35f19
SSDEEP 1536:2uXw6gQxsf4u9oFcYXQWq9afYRj9SnwLBrmKPBPWBhSCTG9vCNNw822R2yrh7t:h1m48oFceWRj9SkBrmKPB4SCo2N922Ea
MD5 SHA1 SHA512 SSDEEP

Sharing

General

Malware Config

Signatures

File Explorer

Bootstrapper.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$TEMP/Achieved.aifc

$TEMP/Belfast.aifc

Analyze

Artwork

Dining

Dust

Implementation

Perry

Personalized

Reach

Richardson

Supplies

Thanks

Timothy

$TEMP/Central.aifc

$TEMP/Customize.aifc

$TEMP/Dave.aifc

$TEMP/Mac.aifc

$TEMP/Minolta.aifc

$TEMP/Pe.aifc

$TEMP/Significantly.aifc