Madium-Bootstrapper.zip
- SHA256 8cde425e1913189403d07c4d14dd9acba8eafe35c9478f4a873e81d80bf9caba
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Madium-Bootstrapper.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Madium-Bootstrapper.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target Madium-Bootstrapper.zip
- Size 3.2MB
- Sample260803-ntmxdaaj8w
- SHA256 8cde425e1913189403d07c4d14dd9acba8eafe35c9478f4a873e81d80bf9caba
- MD5 f91a41b4148fd20f5c91b405a4685dcd
- SHA1 b391bbe69bad41278dbb9411522cc68aad6bbfb6
- SHA512 4b36156549284e6b27c5a4a5a400b38116a748f7f04dde47965c345a7f6240b3b18c26e7db71f7df50ab00b826c66a24b41f83bbb72c95a927289585cc60216d
- SSDEEP 98304:yjv+kzDDipbhih0EmiCO6ewZM3b8RmPGh:ybzC3ih0EikrcmPs
- TLSH T1ABE533C081514F7E17CEBDB7C9280E601550F8D2B694228A9B647FBB7662F5E8F18B81
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Madium-Bootstrapper.exe
File Explorer
-
Madium-Bootstrapper.zip.zip 3.2MB
-
Madium-Bootstrapper.exe.exe 6.9MB
Madium-Bootstrapper.exe
- IMPHASH dafc370eb0a4203e8f3e83461327c862
- SHA256 5e6f74e8c460c747e6cd94cea8fa21271a83734b791e31a6e3c4d4e5f693efcb
- MD5 81ee0f82e959c755bdcb29c510249fbe
- SHA1 c6f9839f5452732af66b08a8ab9872f4f4bfc363
- SHA512 5873121197183f06e492d46e90a73550de261494a1a1572d16b9f295ad094acdd0df1f2415d41127751847e11bfb1c5216a0cf71a0eeaff9d06e364936e33522
- SSDEEP 98304:r+q6pQE5qQhw2AHVPVKKInBdw+gpiMQwySjcTc:rpYl9hw2AHVPVKKIQngwlj
- TLSH T11C76CF69A6BC00E9E466C1BCC2875223EB72B91517B153CF5A649AF60F23AD01F7F740
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4196712
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
bcrypt
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptGetProperty
crypt32
CertOpenSystemStoreW
CertGetCertificateContextProperty
CertFindCertificateInStore
CertOpenStore
CertOpenSystemStoreA
CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage
CertFreeCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertDuplicateCertificateContext
winhttp
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpSetOption
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpConnect
WinHttpQueryHeaders
WinHttpCloseHandle
WinHttpOpen
WinHttpCrackUrl
shell32
ShellExecuteExW
CommandLineToArgvW
SHGetFolderPathW
ole32
CoUninitialize
CoInitializeEx
CoCreateInstance
CreateStreamOnHGlobal
CoCreateGuid
CoTaskMemFree
StringFromGUID2
gdiplus
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipDeleteRegion
GdipCreateRegionPath
GdipAddPathRectangle
GdipAddPathArc
GdipClosePathFigure
GdipDeletePath
GdipCreatePath
GdiplusShutdown
GdiplusStartup
GdipFree
GdipSetPenStartCap
GdipSetPenEndCap
GdipCloneImage
GdipDisposeImage
GdipGetImageWidth
GdipDisposeImageAttributes
GdipGetImageHeight
GdipCreateBitmapFromStream
GdipCreateImageAttributes
GdipSetImageAttributesColorMatrix
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipSetPixelOffsetMode
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipDrawLine
GdipFillRectangleI
GdipFillPath
GdipDrawImageRectRect
GdipSetClipRegion
GdipResetClip
GdipDeletePen
GdipAlloc
dwmapi
DwmSetWindowAttribute
advapi32
EventRegister
EventSetInformation
EventWriteTransfer
EventUnregister
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegGetValueW
DeregisterEventSource
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
CryptDestroyKey
CryptSignHashW
CryptEnumProvidersW
CryptSetHashParam
secur32
InitSecurityInterfaceW
ws2_32
WSAIoctl
WSASetLastError
socket
setsockopt
recv
htons
getsockname
getpeername
connect
closesocket
bind
accept
__WSAFDIsSet
WSAStartup
ntohs
WSAGetLastError
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
send
shutdown
gethostbyaddr
gethostbyname
select
getaddrinfo
freeaddrinfo
inet_ntoa
inet_addr
sendto
recvfrom
WSASocketA
listen
ioctlsocket
WSACleanup
htonl
getservbyport
getservbyname
getsockopt
iphlpapi
if_nametoindex
kernel32
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
RtlUnwindEx
RtlLookupFunctionEntry
RaiseException
RtlPcToFileHeader
InitializeSListHead
GetStartupInfoW
SetUnhandledExceptionFilter
GetStringTypeW
SleepConditionVariableSRW
WakeAllConditionVariable
TryAcquireSRWLockExclusive
GetSystemTimePreciseAsFileTime
GetCPInfo
CompareStringEx
LCMapStringEx
DecodePointer
EncodePointer
ExitThread
GetFileInformationByHandleEx
FreeLibraryAndExitThread
GetDriveTypeW
GetFileInformationByHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
SetStdHandle
SetConsoleCtrlHandler
SetFilePointerEx
GetConsoleOutputCP
GetCurrentProcess
ExitProcess
TerminateProcess
IsProcessorFeaturePresent
RtlCaptureContext
IsDebuggerPresent
UnhandledExceptionFilter
HeapAlloc
GetDateFormatW
GetTimeFormatW
CompareStringW
AreFileApisANSI
CreateFile2
SetFileInformationByHandle
GetFileAttributesExW
FindFirstFileExW
CreateDirectoryW
GetCurrentDirectoryW
GetLocaleInfoEx
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetFileSizeEx
HeapReAlloc
SetEndOfFile
GetTimeZoneInformation
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
WriteConsoleW
HeapSize
RtlVirtualUnwind
ConvertThreadToFiberEx
ConvertFiberToThread
WriteFile
GetACP
CreateSemaphoreA
GetExitCodeThread
WaitForSingleObject
ReleaseSemaphore
InitializeCriticalSection
LoadLibraryA
GetSystemDirectoryA
GetModuleHandleExW
FormatMessageA
GetCommandLineW
LocalFree
DeleteFileW
MoveFileExW
GetModuleFileNameW
Sleep
GetTickCount
GetModuleHandleW
LoadResource
LockResource
SizeofResource
FindResourceW
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
MulDiv
GetTempPathW
MultiByteToWideChar
GetFileAttributesW
FormatMessageW
WideCharToMultiByte
GetLastError
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SleepEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeConditionVariable
SetLastError
CreateFileW
GetFullPathNameW
GetEnvironmentVariableA
CompareFileTime
GetSystemTimeAsFileTime
VerSetConditionMask
GetProcAddress
VerifyVersionInfoW
RtlUnwind
CloseHandle
WakeConditionVariable
SleepConditionVariableCS
WaitForSingleObjectEx
CreateThread
OutputDebugStringA
OutputDebugStringW
GetProcessHeap
HeapFree
LoadLibraryExW
LoadLibraryW
FreeLibrary
GetEnvironmentVariableW
GetCurrentProcessId
GetFileType
GetStdHandle
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
InitializeSRWLock
ReleaseSRWLockShared
AcquireSRWLockShared
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
VirtualProtect
VirtualFree
SwitchToFiber
DeleteFiber
CreateFiberEx
GetSystemTime
SystemTimeToFileTime
FindClose
FindFirstFileW
FindNextFileW
user32
GetUserObjectInformationW
SetProcessDpiAwarenessContext
LoadIconW
LoadCursorW
PtInRect
MessageBoxW
GetWindowRect
GetProcessWindowStation
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
PostMessageW
DefWindowProcW
PostQuitMessage
RegisterClassW
CreateWindowExW
IsWindow
DestroyWindow
ShowWindow
SetWindowPos
SetCapture
ReleaseCapture
SetTimer
KillTimer
GetSystemMetrics
DrawTextW
UpdateWindow
GetDC
ReleaseDC
BeginPaint
EndPaint
InvalidateRect
GetClientRect
gdi32
SetBkMode
SelectObject
GetStockObject
SetTextColor
EnumFontFamiliesExW
GetDeviceCaps
BitBlt
DeleteObject
DeleteDC
CreateFontW
CreateCompatibleDC
CreateCompatibleBitmap
Name
.text
Size
4.2MB
Virtual Size
4.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
41KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
202KB
Virtual Size
202KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
942KB
Virtual Size
941KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
58KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=197, id=261, version=33145,
count=16, id=259, version=33145,
count=10, id=259, version=35403,
count=19, id=260, version=35403,
count=99, id=261, version=35403,
count=21, id=260, version=33145,
count=29, id=257, version=33145,
count=383, id=1, productName=Unmarked objects,
count=2, id=260, version=35725,
count=48, productName=Unmarked objects (old),
count=1054, id=260, version=36307,
count=13, id=261, version=35725,
count=1, id=255, version=35725,
count=1, id=151,
count=1, id=258, version=35725,