Static task
static1
Behavioral task
behavioral1
Sample
bypassPS-CLM.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
bypassPS-CLM.exe
Resource
win10v2004-20230220-en
General
-
Target
bypassPS-CLM.exe
-
Size
5KB
-
MD5
b3f7f45efe8a55ed14efa8fe04b72cf0
-
SHA1
6782e1820e52c826a655ade4bd6cea30f5bacb65
-
SHA256
8af5a9459ae3f64af51f28fd85e4e433d35a985f51156c5a18d287249cd6d760
-
SHA512
bc359f81c4079988154648f03a6123c178cd27cc38cd36a9194eda8efb12695a2a964fbcce0b4cd4f84d7242f220022620cc08c8be6966e6206064a874334359
-
SSDEEP
96:35zO/w2Vdeps8B4ig+s3+1+HhZTCDu30MNzNt:3RScs8qt+gkshZGDunn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bypassPS-CLM.exe
Files
-
bypassPS-CLM.exe.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ