General

  • Target
    BootstrapperNew.exe
  • Size 8.3MB
  • Sample260713-e6stqady9x
  • SHA256 82e8904fd500c596b04786124a0515f1ecb9b9fc8b2187e449c30eeba1ba2316
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10

Malware Config

Signatures

  • Unsigned PE 4 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • BootstrapperNew.exe
    .exe 8.3MB
  • costura.dll
    .dll 5KB
  • costura.pdb
    7KB
  • microsoft.aspnetcore.systemwebadapters.dll
    .dll 21KB
  • microsoft.aspnetcore.systemwebadapters.pdb
    5KB
  • microsoft.bcl.asyncinterfaces.dll
    .dll 25KB
  • microsoft.windowsapicodepack.dll
    .dll 96KB
  • microsoft.windowsapicodepack.shell.dll
    .dll 529KB
  • newtonsoft.json.dll
    .dll 695KB
  • presentationcore.dll
    .dll 1.3MB
  • presentationframework.dll
    .dll 2.0MB
  • system.buffers.dll
    .dll 20KB
  • system.codedom.dll
    .dll 29KB
  • system.data.dll
    .dll 1.2MB
  • system.io.compression.filesystem.dll
    .dll 23KB
  • system.io.pipelines.dll
    .dll 82KB
  • system.memory.dll
    .dll 138KB
  • system.net.http.dll
    .dll 84KB
  • system.numerics.vectors.dll
    .dll 113KB
  • system.runtime.compilerservices.unsafe.dll
    .dll 18KB
  • system.text.encodings.web.dll
    .dll 77KB
  • system.text.json.dll
    .dll 709KB
  • system.threading.tasks.extensions.dll
    .dll 25KB
  • system.valuetuple.dll
    .dll 24KB
  • system.windows.forms.dll
    .dll 2.4MB
  • system.xaml.dll
    .dll 108KB
  • system.xml.dll
    .dll 903KB
  • system.xml.linq.dll
    .dll 44KB
  • windowsbase.dll
    .dll 655KB
  • wpfanimatedgif.dll
    .dll 41KB
  • wpfanimatedgif.pdb
    16KB

BootstrapperNew.exe

  • SHA256 82e8904fd500c596b04786124a0515f1ecb9b9fc8b2187e449c30eeba1ba2316
  • MD5 SHA1 SHA512 SSDEEP TLSH
Digest
fd:a2:50:bf:04:a6:30:0d:47:f1:f5:dd:05:39:46:98:c1:5c:19:b7:cd:62:b3:35:b9:f1:37:7c:ee:69:a6:e3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=CMD Softworks LLC,O=CMD Softworks LLC,L=Albuquerque,ST=New Mexico,C=US
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths