Bootstrapper[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Bootstrapper.exe
Size 29.9MB
Sample260705-cjx4tact2n
SHA256 7864984725be67523dd5913907f24dee7149a1bc9b346c826a4c0d4047f78561
MD5 10f94b5e201f7be986454ceb7acc67c2
SHA1 c2bc385eeba6b1de073b76effc3c0790af387366
SHA512 1f4f606fdde0ffdd19c43760161049b49de66a6b3a7f9fe5ef20f300e120db9f874d99ae115b94008f6c7e79f7c64b57bfbaca1141e80f6c4c92893d494cd6e6
SSDEEP 393216:IFE9PbSExr+LxGDtcmtjhemz6hbk/zw+5EVlUxECz2mpMHkC1UH9ScTUVCnEwENk:IFEpRiBiBEk/JYqVzGE7FYV4h
TLSH
T1BA67239265DAA2D8E7C30904254910CB23C1B8EAD5FED6597FC65C036860EEB4C9DFB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Bootstrapper.exe

File Explorer

Bootstrapper.exe

.exe 29.9MB

Bootstrapper.exe

IMPHASH 965b0236fdfae794ad3f4d497e287041
SHA256 7864984725be67523dd5913907f24dee7149a1bc9b346c826a4c0d4047f78561
MD5 10f94b5e201f7be986454ceb7acc67c2
SHA1 c2bc385eeba6b1de073b76effc3c0790af387366
SHA512 1f4f606fdde0ffdd19c43760161049b49de66a6b3a7f9fe5ef20f300e120db9f874d99ae115b94008f6c7e79f7c64b57bfbaca1141e80f6c4c92893d494cd6e6
SSDEEP 393216:IFE9PbSExr+LxGDtcmtjhemz6hbk/zw+5EVlUxECz2mpMHkC1UH9ScTUVCnEwENk:IFEpRiBiBEk/JYqVzGE7FYV4h
TLSH
T1BA67239265DAA2D8E7C30904254910CB23C1B8EAD5FED6597FC65C036860EEB4C9DFB3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

32873158

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ntdll

RtlAdjustPrivilege

rpcrt4

UuidToStringA

ws2_32

sendto

crypt32

CryptDecodeObjectEx

gdiplus

GdipSaveImageToFile

wldap32

ord301

normaliz

IdnToAscii

kernel32

GetCurrentThreadId GetSystemTimeAsFileTime HeapAlloc HeapFree ExitProcess LoadLibraryA GetModuleHandleA GetProcAddress

user32

SetWindowLongPtrA

advapi32

CryptReleaseContext

shell32

ShellExecuteExA

msvcp140

??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

api-ms-win-crt-runtime-l1-1-0

_beginthreadex

api-ms-win-crt-stdio-l1-1-0

fputc

api-ms-win-crt-utility-l1-1-0

srand

api-ms-win-crt-string-l1-1-0

isupper

api-ms-win-crt-filesystem-l1-1-0

_unlock_file

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-math-l1-1-0

__setusermatherr

Name

.text

Size

Virtual Size

519KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tg5

Size

Virtual Size

18.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.C;]

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gxb

Size

29.9MB

Virtual Size

29.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

684B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Bootstrapper.exe

ntdll

rpcrt4

ws2_32

crypt32

gdiplus

wldap32

normaliz

kernel32

user32

advapi32

shell32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

generic