Static task
static1
Behavioral task
behavioral1
Sample
friendly bypass_[unknowncheats.me]_.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral2
Sample
friendly bypass_[unknowncheats.me]_.dll
Resource
win7-20231215-en
Behavioral task
behavioral3
Sample
friendly bypass_[unknowncheats.me]_.dll
Resource
win10-20231215-en
Behavioral task
behavioral4
Sample
friendly bypass_[unknowncheats.me]_.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
friendly bypass_[unknowncheats.me]_.dll
Resource
win11-20231215-en
General
-
Target
friendly bypass_[unknowncheats.me]_.dll
-
Size
88KB
-
MD5
1d6616330ac744da63ab9e4d8a4dd8a1
-
SHA1
55ba73ccb6715096d6d8a782e91b18b68ad882e8
-
SHA256
ba6c1e8e18cba7479d95963979f831a61aa4a835ff6bdfe8dad06089d1f5548d
-
SHA512
815e98357632d8aac3eb9e23d0e3c327674238318e5b8be2b6c537b9b53c24d93a912d10e2fd4ea814740f467449ba08d452e90586fec6093dc1ebc6239c9eb6
-
SSDEEP
1536:nKnvH7zGV7SnXG9U1vDoWdxKSSIQYn4GY9dloKVgfsbnVOI0e:nKnvH7zGVKGU7oWdxFyYn4GIntnVOK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource friendly bypass_[unknowncheats.me]_.dll
Files
-
friendly bypass_[unknowncheats.me]_.dll.dll windows:6 windows x64 arch:x64
0e67a82500631e07683566bae93d2a4a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
CreateFileW
DeleteCriticalSection
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FlushFileBuffers
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleCP
GetConsoleMode
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetFileType
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
InitializeSListHead
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
K32GetModuleInformation
LCMapStringW
LeaveCriticalSection
LoadLibraryExW
MultiByteToWideChar
QueryPerformanceCounter
RaiseException
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualProtect
WideCharToMultiByte
WriteConsoleW
WriteFile
Sections
.text Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 424B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ