ChamsBypass[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ChamsBypass.exe
Size

1.3MB
MD5

393e5d6b866ed81b6eee4bd3303b6149
SHA1

b0675519bb2d5fbbde8bf4c0b3574444e305278f
SHA256

2d192cc7897a392ac3f8bf07048ef770e2c39039ad8222d9d2897109cb1c5aa2
SHA512

29326088edf1db0fe865a29db370a4d7b03fa32e25781f69739cbba4579defe5213a5728f8a04fb34b9c415eebf2af4dc7c02638f0d9b1600608eb84dc0a22c7
SSDEEP

24576:d/2amL1Xek+YzMgyP/4P+qBni55pasA68qUz85Fe8sxUKqW2Xzi4:ZyJekW/UTE54P6E2sxUKqW2Xm4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ChamsBypass.exe

Files

ChamsBypass.exe
.exe windows:4 windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE