Static task
static1
Behavioral task
behavioral1
Sample
Bye.exe
Resource
win7-20230712-es
Behavioral task
behavioral2
Sample
Bye.exe
Resource
win10v2004-20230703-es
General
-
Target
Bye.exe
-
Size
860KB
-
MD5
29a1520735eb6be109f89ad55982114c
-
SHA1
780427400155b46479b18256aecfd3e45b4eab1a
-
SHA256
21ab25de0157510d3b7c56223e8e71f9650d7a58a3de4fe4e1d7b42a1daafdea
-
SHA512
ad993d31ec1a5f249115dc28d4eb4eaf993a794fdb12020664f15cf488f6550e869a937582315cab14e2074bb5eaa087139d00946422f588bdddf570f1a21692
-
SSDEEP
12288:fGJE+xmyS9RXXyK9jJWa1ARTVRQjJWa1ARTVRLPpJmWDhPNL/Zt:vBlJjawJjaZmmZh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Bye.exe
Files
-
Bye.exe.exe windows x86
084e6d6c855fc7c6909062eb55ce55d6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
HeapSize
CreateFileW
LCMapStringW
CompareStringW
GetStringTypeW
GetFileType
WriteConsoleW
GetProcAddress
GetProcessHeap
LoadLibraryW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
HeapFree
CloseHandle
WaitForSingleObject
GetExitCodeProcess
CreateProcessW
GetFileAttributesExW
HeapAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
DecodePointer
user32
DefWindowProcW
DestroyWindow
MessageBoxW
CreateWindowExW
SendMessageW
EndDialog
RegisterClassExW
LoadAcceleratorsW
LoadStringW
ShowWindow
GetMessageW
TranslateAcceleratorW
TranslateMessage
LoadIconW
LoadCursorW
GetClientRect
PostQuitMessage
GetDesktopWindow
DialogBoxParamW
UpdateWindow
BeginPaint
DispatchMessageW
gdi32
CreateCompatibleDC
GetObjectW
SelectObject
Sections
.text Size: 58KB - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 769KB - Virtual size: 769KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ