Madium-Bootstrapper.zip
- SHA256 75f591ec8e82ecd143769c515f919cb1d61be158ead37238edec58080d6cb575
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Madium-Bootstrapper.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
Madium-Bootstrapper.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
20 signatures
150 seconds
General
- Target Madium-Bootstrapper.zip
- Size 3.2MB
- Sample260702-dthybabv3y
- SHA256 75f591ec8e82ecd143769c515f919cb1d61be158ead37238edec58080d6cb575
- MD5 6b4f0b1696256b71541bc6a293103704
- SHA1 978f7c7b04fba2e6966c23927de29a51ae2506aa
- SHA512 cf963828f21386b084014f4296d998f18985d7cf7d372803a37c275b3b4527133026241592ddf25daa8df0fb967054de4d089fd31ea02a2f7bf7b372df719bed
- SSDEEP 49152:00gdei9Ls69ridKJ7yk8csy59GbnhOAG6fyoK+wocWALjE66eQmHcBGAQkIZlFJ1:JG3pJO9nOAG6frcOYQccBGAz8lFJIGvb
- TLSH T1EDE53396BFEC2C05EE2D7C9F4B501250FFA22A479B8D4294471646BF0825E21C6ADCDF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Madium-Bootstrapper.exe
File Explorer
-
Madium-Bootstrapper.zip.zip 3.2MB
-
Madium-Bootstrapper.exe.exe 6.9MB
Madium-Bootstrapper.exe
- IMPHASH df9c2a702d0f7ff2fb0f44c30f1ef79e
- SHA256 1650251facc91ff98b7c710c9a3949ddcc1c91c08fd4c789ca0295be977c0b26
- MD5 eb557c8a6c10e7d92e2955fea2ac788b
- SHA1 430df41170fe3e209f44f2dfa5c37f40f6edb101
- SHA512 c4f5a533f8e58c29082864b44bf94c51a7619c4cef87f07639c6d6a4f04aa5c17dd587004db69572d7ef87b34bfb62ab25a538c48de1c638220beab47a3a7024
- SSDEEP 98304:zKvnZ1DquE2Dk4GjV+AiO+vf04MQwySjcTc:G/bquE2Dk4GjVjFoPwlj
- TLSH T12776BF69A6BC00E9E466C1BCC2875223EB72B51517B157CF5A248AF60F63AD02F7F740
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4199760
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
bcrypt
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptGetProperty
crypt32
CertOpenSystemStoreW
CertGetCertificateContextProperty
CertFindCertificateInStore
CertOpenStore
CertOpenSystemStoreA
CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage
CertFreeCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertDuplicateCertificateContext
winhttp
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpSetOption
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpConnect
WinHttpQueryHeaders
WinHttpCloseHandle
WinHttpOpen
WinHttpCrackUrl
shell32
ShellExecuteExW
CommandLineToArgvW
SHGetFolderPathW
ole32
CoUninitialize
CoInitializeEx
CoCreateInstance
CreateStreamOnHGlobal
CoCreateGuid
CoTaskMemFree
StringFromGUID2
gdiplus
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipDeleteRegion
GdipCreateRegionPath
GdipAddPathRectangle
GdipAddPathArc
GdipClosePathFigure
GdipDeletePath
GdipCreatePath
GdiplusShutdown
GdiplusStartup
GdipFree
GdipSetPenStartCap
GdipSetPenEndCap
GdipCloneImage
GdipDisposeImage
GdipGetImageWidth
GdipDisposeImageAttributes
GdipGetImageHeight
GdipCreateBitmapFromStream
GdipCreateImageAttributes
GdipSetImageAttributesColorMatrix
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipSetPixelOffsetMode
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipDrawLine
GdipFillRectangleI
GdipFillPath
GdipDrawImageRectRect
GdipSetClipRegion
GdipResetClip
GdipDeletePen
GdipAlloc
dwmapi
DwmSetWindowAttribute
advapi32
EventRegister
EventSetInformation
EventWriteTransfer
EventUnregister
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegGetValueW
DeregisterEventSource
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
CryptDestroyKey
CryptSignHashW
CryptEnumProvidersW
CryptSetHashParam
secur32
InitSecurityInterfaceW
ws2_32
WSAIoctl
WSASetLastError
socket
setsockopt
recv
htons
getsockname
getpeername
connect
closesocket
bind
accept
__WSAFDIsSet
WSAStartup
ntohs
WSAGetLastError
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
send
shutdown
gethostbyaddr
gethostbyname
select
getaddrinfo
freeaddrinfo
inet_ntoa
inet_addr
sendto
recvfrom
WSASocketA
listen
ioctlsocket
WSACleanup
htonl
getservbyport
getservbyname
getsockopt
iphlpapi
if_nametoindex
kernel32
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
RtlUnwindEx
RtlLookupFunctionEntry
RaiseException
RtlPcToFileHeader
InitializeSListHead
GetStartupInfoW
SetUnhandledExceptionFilter
GetStringTypeW
SleepConditionVariableSRW
WakeAllConditionVariable
GetCPInfo
CompareStringEx
LCMapStringEx
DecodePointer
EncodePointer
ExitThread
GetFileInformationByHandleEx
FreeLibraryAndExitThread
GetDriveTypeW
GetFileInformationByHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
SetStdHandle
SetConsoleCtrlHandler
SetFilePointerEx
GetConsoleOutputCP
GetCurrentProcess
ExitProcess
TerminateProcess
IsProcessorFeaturePresent
RtlCaptureContext
IsDebuggerPresent
UnhandledExceptionFilter
HeapAlloc
GetDateFormatW
GetTimeFormatW
CompareStringW
AreFileApisANSI
CreateFile2
SetFileInformationByHandle
GetFileAttributesExW
FindFirstFileExW
CreateDirectoryW
GetCurrentDirectoryW
GetLocaleInfoEx
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetFileSizeEx
HeapReAlloc
SetEndOfFile
IsValidCodePage
GetOEMCP
GetTimeZoneInformation
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
WriteConsoleW
HeapSize
RtlVirtualUnwind
ConvertThreadToFiberEx
ConvertFiberToThread
WriteFile
GetACP
CreateSemaphoreA
GetExitCodeThread
WaitForSingleObject
ReleaseSemaphore
InitializeCriticalSection
LoadLibraryA
GetSystemDirectoryA
GetModuleHandleExW
FormatMessageA
GetCommandLineW
LocalFree
DeleteFileW
MoveFileExW
GetModuleFileNameW
Sleep
GetTickCount
GetModuleHandleW
LoadResource
LockResource
SizeofResource
FindResourceW
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
MulDiv
GetTempPathW
MultiByteToWideChar
GetFileAttributesW
FormatMessageW
WideCharToMultiByte
GetLastError
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SleepEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeConditionVariable
SetLastError
CreateFileW
GetFullPathNameW
GetEnvironmentVariableA
CompareFileTime
GetSystemTimeAsFileTime
VerSetConditionMask
GetProcAddress
VerifyVersionInfoW
RtlUnwind
CloseHandle
WakeConditionVariable
SleepConditionVariableCS
WaitForSingleObjectEx
CreateThread
OutputDebugStringA
OutputDebugStringW
GetProcessHeap
HeapFree
LoadLibraryExW
LoadLibraryW
FreeLibrary
GetEnvironmentVariableW
GetCurrentProcessId
GetFileType
GetStdHandle
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
InitializeSRWLock
ReleaseSRWLockShared
AcquireSRWLockShared
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
VirtualProtect
VirtualFree
SwitchToFiber
DeleteFiber
CreateFiberEx
GetSystemTime
SystemTimeToFileTime
FindClose
FindFirstFileW
FindNextFileW
user32
GetUserObjectInformationW
SetProcessDpiAwarenessContext
LoadIconW
LoadCursorW
PtInRect
MessageBoxW
GetWindowRect
GetProcessWindowStation
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
PostMessageW
DefWindowProcW
PostQuitMessage
RegisterClassW
CreateWindowExW
IsWindow
DestroyWindow
ShowWindow
SetWindowPos
SetCapture
ReleaseCapture
SetTimer
KillTimer
GetSystemMetrics
DrawTextW
UpdateWindow
GetDC
ReleaseDC
BeginPaint
EndPaint
InvalidateRect
GetClientRect
gdi32
SetBkMode
SelectObject
GetStockObject
SetTextColor
EnumFontFamiliesExW
GetDeviceCaps
BitBlt
DeleteObject
DeleteDC
CreateFontW
CreateCompatibleDC
CreateCompatibleBitmap
Name
.text
Size
4.2MB
Virtual Size
4.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
41KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
203KB
Virtual Size
202KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
942KB
Virtual Size
941KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
58KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=197, id=261, version=33145,
count=16, id=259, version=33145,
count=10, id=259, version=35721,
count=19, id=260, version=35721,
count=99, id=261, version=35721,
count=21, id=260, version=33145,
count=29, id=257, version=33145,
count=383, id=1, productName=Unmarked objects,
count=2, id=260, version=36231,
count=48, productName=Unmarked objects (old),
count=1054, id=260, version=36307,
count=13, id=261, version=36231,
count=1, id=255, version=36231,
count=1, id=151,
count=1, id=258, version=36231,