DewBypass[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

DewBypass.exe
Size

5.4MB
MD5

1003f491e08e186c4f3f3e9ee92a63f7
SHA1

8f8206b98c48216ce5fc89f978f865abd728337f
SHA256

d5549710875cc402352a41a0bc9d1d231c623c8dd25fb811d88705b9b4bf3842
SHA512

d2d5cdb9ae3b5b8101f1b7472038d3719724905527d8a526f165152faf31d11e78e76651dd8992b897d08d41670e098ffcb865cb80610ff43a1c5303f20dab58
SSDEEP

98304:TvROX69xLd90LQxvoomAKV6J5h/DN1dj12FjFvS0b8XyJQ5N8t5WK:t8LsvowKAJ5hLTeb875Nub

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DewBypass.exe

Files

DewBypass.exe
.exe windows x86

ab9a7f504ea5936a8f1b87683fc88edd

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExA
GetVersion
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

SetWindowPos
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

advapi32

RegCreateKeyExA

shell32

SHGetSpecialFolderPathW

ole32

CLSIDFromString

shlwapi

StrToIntExW

gdi32

CreateBitmap

wininet

InternetGetCookieA

dbghelp

MakeSureDirectoryPathExists

oleaut32

VariantCopy

winspool.drv

ClosePrinter

comctl32

ord17

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 477KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 702KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

CdDaYO0
Size: - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

CdDaYO1
Size: 5.4MB - Virtual size: 5.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ab9a7f504ea5936a8f1b87683fc88edd

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

shlwapi

gdi32

wininet

dbghelp

oleaut32

winspool.drv

comctl32

wtsapi32

Sections

.text Size: - Virtual size: 477KB

.rdata Size: - Virtual size: 25KB

.data Size: - Virtual size: 702KB

CdDaYO0 Size: - Virtual size: 2.9MB

CdDaYO1 Size: 5.4MB - Virtual size: 5.4MB

.rsrc Size: 4KB - Virtual size: 1KB

.text
Size: - Virtual size: 477KB

.rdata
Size: - Virtual size: 25KB

.data
Size: - Virtual size: 702KB

CdDaYO0
Size: - Virtual size: 2.9MB

CdDaYO1
Size: 5.4MB - Virtual size: 5.4MB

.rsrc
Size: 4KB - Virtual size: 1KB