bootstrapperCrashHandler[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
bootstrapperCrashHandler.exe
Size 1.2MB
Sample261027-xctg9sty2k
SHA256 6f7409aa4a9e1a1f3e0f1e672346cfc7879e49a66caa39671320dc3512f8ae5e
MD5 a4233eda2a29203f7cb17c49d5d2154c
SHA1 18af508af77bdf96f3cb2896eead77b28d743878
SHA512 c558413d1534dc4a3952732ae0fbd0a297ced4739d26a6da4d7ecfcd34567581b5653b3a876e290e31cca724363938b61b0aab4f90a1e06e5cf3027ed52ded28
SSDEEP 24576:RteNxf8RlOpKO/yur5H5oY03aaVHf/kwhafvu55:WxkR8/yur5HeY03aa9f/kwGvu55
TLSH
T16F556D1AB7E841BCD5BBD1389A678547EBB178064B718ADF02A1075E1F33AE04E3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

bootstrapperCrashHandler.exe

.exe 1.2MB

bootstrapperCrashHandler.exe

IMPHASH 554a478b4125a6549116579382efecb4
SHA256 6f7409aa4a9e1a1f3e0f1e672346cfc7879e49a66caa39671320dc3512f8ae5e
MD5 a4233eda2a29203f7cb17c49d5d2154c
SHA1 18af508af77bdf96f3cb2896eead77b28d743878
SHA512 c558413d1534dc4a3952732ae0fbd0a297ced4739d26a6da4d7ecfcd34567581b5653b3a876e290e31cca724363938b61b0aab4f90a1e06e5cf3027ed52ded28
SSDEEP 24576:RteNxf8RlOpKO/yur5H5oY03aaVHf/kwhafvu55:WxkR8/yur5HeY03aa9f/kwGvu55
TLSH
T16F556D1AB7E841BCD5BBD1389A678547EBB178064B718ADF02A1075E1F33AE04E3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

1c:b1:48:3b:20:1a:23:6e:2e:8f:76:40:04:ca:c6:b4:7d:63:6a:30:fd:5d:43:88:02:1f:70:59:d1:a0:31:6e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=2256184,CN=Activision Publishing Inc,OU=Activision Publishing Inc,O=Activision Publishing Inc,L=SANTA MONICA,ST=CALIFORNIA,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Nov 30, 2022

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

02:be:ce:7b:b8:8a:fb:72:01:6d:a4:35:49:bb:26:66

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 11, 2021 - Jan 10, 2023

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

860428

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\trees\core-dev\game_iw9\pc\codCrashHandler.pdb

kernel32

TerminateProcess OpenProcess K32GetModuleBaseNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection Sleep GetEnvironmentVariableA ReleaseMutex GetModuleFileNameW CompareFileTime FindClose LoadLibraryW FindNextFileW ReadFile GetSystemTimeAsFileTime MoveFileW OpenMutexA SetProcessPreferredUILanguages SetEvent CreateEventW InitializeSListHead GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsDebuggerPresent WaitForSingleObjectEx ResetEvent InitializeCriticalSectionAndSpinCount IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext FreeLibrary ReadProcessMemory GetProcessId GetCurrentDirectoryW OutputDebugStringW K32GetPerformanceInfo K32GetProcessMemoryInfo MoveFileExW DeleteFileW SystemTimeToFileTime GetSystemTime GetProcAddress GetModuleHandleA VerSetConditionMask WaitForSingleObject WideCharToMultiByte MultiByteToWideChar FormatMessageW GetModuleHandleW GetCurrentProcess GetLastError GetTempPathW GetTempFileNameW GetFileSizeEx GetFileAttributesW CreateFileW CreateDirectoryW CreateProcessW FindFirstFileW CloseHandle

user32

EnableWindow MessageBeep GetParent LoadImageW DestroyWindow GetDlgItem IsDlgButtonChecked GetDlgCtrlID IsWindowEnabled GetSysColor BeginPaint EndPaint LoadIconW DestroyIcon WaitForInputIdle EnumThreadWindows LoadStringW GetDlgItemTextW EndDialog ShowWindow IsIconic SetForegroundWindow GetDC ReleaseDC GetClientRect MapWindowPoints GetDesktopWindow DialogBoxParamW BringWindowToTop SetWindowPos SendMessageW MonitorFromRect MonitorFromWindow SetThreadDpiAwarenessContext GetAwarenessFromDpiAwarenessContext

gdi32

GetObjectW SetTextColor SetBkMode SetBkColor CreateSolidBrush SetBrushOrgEx SetStretchBltMode CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject GetDIBits CreateFontIndirectW StretchBlt SelectObject

advapi32

RegQueryValueExA AdjustTokenPrivileges LookupPrivilegeValueW RegCloseKey RevertToSelf ImpersonateSelf OpenProcessToken RegOpenKeyExA

shell32

ShellExecuteA Shell_NotifyIconW ShellExecuteW

ole32

CLSIDFromString

msvcp140

?_Xlength_error@std@@YAXPEBD@Z ?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?id@?$collate@_W@std@@2V0locale@2@A ?id@?$ctype@_W@std@@2V0locale@2@A ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Xbad_alloc@std@@YAXXZ _Wcscoll _Wcsxfrm ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??Bid@locale@std@@QEAA_KXZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?is@?$ctype@_W@std@@QEBA_NF_W@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z _Mtx_init_in_situ _Mtx_destroy_in_situ _Xtime_get_ticks ?_Random_device@std@@YAIXZ _Mtx_lock _Mtx_unlock ?_Throw_C_error@std@@YAXH@Z _Thrd_id ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z ?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z ?_XGetLastError@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z

shlwapi

PathFindFileNameW

gdiplus

GdipSaveImageToFile GdipCreateBitmapFromHBITMAP GdiplusShutdown GdiplusStartup GdipDisposeImage

comctl32

ord380 InitCommonControlsEx ord345

winhttp

WinHttpSendRequest WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpSetOption WinHttpConnect WinHttpReadData WinHttpReceiveResponse WinHttpSetStatusCallback WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle

vcruntime140

__std_exception_copy __current_exception_context __current_exception __C_specific_handler memchr __std_terminate __CxxFrameHandler3 memset strchr memcpy memmove _purecall __RTDynamicCast wcsstr memcmp _CxxThrowException __std_exception_destroy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s _wfopen_s fread_s fclose fflush __stdio_common_vfprintf __stdio_common_vsprintf __acrt_iob_func __stdio_common_vsnprintf_s __stdio_common_vsnwprintf_s fwrite _set_fmode _ftelli64 _fseeki64 fread _wfopen __p__commode __stdio_common_vswprintf_s

api-ms-win-crt-convert-l1-1-0

_wcstoui64 wcstol wcstoul wcstof strtoll strtod strtoul _wcstoi64 strtoull strtol atoi

api-ms-win-crt-runtime-l1-1-0

__p___argc _exit exit _initterm_e _initterm _get_initial_wide_environment _initialize_wide_environment strerror_s _configure_wide_argv _c_exit terminate _register_thread_local_exe_atexit_callback _set_app_type _seh_filter_exe _invalid_parameter_noinfo_noreturn __p___wargv _invoke_watson _cexit _errno _crt_atexit _register_onexit_function _initialize_onexit_table abort

api-ms-win-crt-string-l1-1-0

wcscpy_s wcsncpy_s toupper strcpy_s _stricmp

api-ms-win-crt-heap-l1-1-0

malloc realloc free _set_new_mode _callnewh

api-ms-win-crt-filesystem-l1-1-0

_splitpath_s _wsplitpath_s

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-math-l1-1-0

_fdtest _dtest __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

bootstrapperCrashHandler.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

msvcp140

shlwapi

gdiplus

comctl32

winhttp

vcruntime140

vcruntime140_1

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic