bootstrapper[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
bootstrapper.exe
Size 11.1MB
Sample260809-bv6dwsgc25
SHA256 1f29d5d82622a09761f40ffb00405533d2a293a1c766f88037f50c981fd4501b
MD5 17531a6c164566a8c84969c27d84833b
SHA1 faf433b26619d7bb4bc5b49cb059266570c25ee0
SHA512 b7caa69271081bfec26eba2bedcdf60a8b6b16f76083706590b189b1a822f3c3d51bb3c1f912cf3542d1664c09999400143238d95cd5be67f3bbc244a16fe96e
SSDEEP 196608:G9sZ5ox4m+ui+kVMgHdnROQMpYZsDRA88aeIrXj9u1PX:G9+ox4vui+OMmRpO5pvwZ
TLSH
T1BEC623DE17DE96B480624640654793A738C4B60C85FD4C293EC76E46AB18CAE248FFF7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bootstrapper.exe

File Explorer

bootstrapper.exe

.exe 11.1MB

bootstrapper.exe

IMPHASH aa8497ea95459e7e54ba3f7dce6f6c0a
SHA256 1f29d5d82622a09761f40ffb00405533d2a293a1c766f88037f50c981fd4501b
MD5 17531a6c164566a8c84969c27d84833b
SHA1 faf433b26619d7bb4bc5b49cb059266570c25ee0
SHA512 b7caa69271081bfec26eba2bedcdf60a8b6b16f76083706590b189b1a822f3c3d51bb3c1f912cf3542d1664c09999400143238d95cd5be67f3bbc244a16fe96e
SSDEEP 196608:G9sZ5ox4m+ui+kVMgHdnROQMpYZsDRA88aeIrXj9u1PX:G9+ox4vui+OMmRpO5pvwZ
TLSH
T1BEC623DE17DE96B480624640654793A738C4B60C85FD4C293EC76E46AB18CAE248FFF7
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8504214

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

1020B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.b7x

Size

Virtual Size

6.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.=Rj

Size

512B

Virtual Size

264B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fs?

Size

11.1MB

Virtual Size

11.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

bootstrapper.exe

kernel32

advapi32

shell32

msvcp140

wininet

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic