KeyAuth[.]cc System Bypass[.]exe | Triage

Sharing

General

Target

KeyAuth.cc System Bypass.exe
Size

758KB
MD5

880bddd26e830789d2eaa7cf4bbfdd26
SHA1

c659d34482ea2ed6facba739898c84b1b9ecc3c0
SHA256

c33723dca43ef3ec43d3abb085e33d5d38431a6a9f509875e44584ce04a88d62
SHA512

61f697fc73070eef0195d95d83314ea40152cdf6821ca244ca0f1beae4d9342a39baeeaa67212936565a92c8e71c2d613281c99f498334d98a647f2400a5e670
SSDEEP

12288:iufV/Twk2b/nSgTv4B3NIcGIwaXM5/mFnltt5TkDCaG3JwuDjnRMbWLsuLOZ3HXd:iuNL2bKgb6ycGIwaXgeldhKG5wuxMcsd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
KeyAuth.cc System Bypass.exe

Files

KeyAuth.cc System Bypass.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

w Z6Pi'
Size: 512B - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 754KB - Virtual size: 753KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

1o)52a=
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ