FIVEM-ESCROW-BYPASS-main[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
FIVEM-ESCROW-BYPASS-main.zip
Size 458KB
Sample240417-qevpsagg56
SHA256 5cfa35212739499c4c98b535529c5637a3d5d1a716f998588e97ac137235c626
MD5 09de2013d81a15bdd0fcd296361f5995
SHA1 0eb4e336cd7ffe0e3a5aae8e9fdd3d26a13e61ad
SHA512 0f0cf56782496853cbe5b84a502d7f108e8a2849a443098a863ad8e9088cb5d72a6a12311b280b5390a88c5cb41c5536eb1ee132bc51aadc5685ed2821f7ab9b
SSDEEP 12288:swScLwHLJcEcqoZ7Yr/LCCsahbLtpECWYtmrKiUE:sDn6E11OwhbhAYiKiB
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/FIVEM-ESCROW-BYPASS-main/FXServer.exe
unpack001/FIVEM-ESCROW-BYPASS-main/bypass.dll

File Explorer

FIVEM-ESCROW-BYPASS-main.zip

.zip 458KB
FIVEM-ESCROW-BYPASS-main/FXServer.exe

.exe 402KB
FIVEM-ESCROW-BYPASS-main/LICENSE

1KB
FIVEM-ESCROW-BYPASS-main/README.md

472B
FIVEM-ESCROW-BYPASS-main/bypass.dll

.dll 277KB

FIVEM-ESCROW-BYPASS-main.zip

SHA256 5cfa35212739499c4c98b535529c5637a3d5d1a716f998588e97ac137235c626
MD5 09de2013d81a15bdd0fcd296361f5995
SHA1 0eb4e336cd7ffe0e3a5aae8e9fdd3d26a13e61ad
SHA512 0f0cf56782496853cbe5b84a502d7f108e8a2849a443098a863ad8e9088cb5d72a6a12311b280b5390a88c5cb41c5536eb1ee132bc51aadc5685ed2821f7ab9b
SSDEEP 12288:swScLwHLJcEcqoZ7Yr/LCCsahbLtpECWYtmrKiUE:sDn6E11OwhbhAYiKiB
MD5 SHA1 SHA512 SSDEEP

FIVEM-ESCROW-BYPASS-main/FXServer.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 7d0aef40fed4cadd574d950932844b19103cd82241067a89e3ecdd8da730d402
MD5 beee5d2e0073c5c54daa29f369404305
SHA1 8f12df303a0b5bcb42ac6ccbe171a13c46d304f1
SHA512 7663f71ee51ea243f6e068b28972b6c401a471fd2035cf23637228aa22ae1b0d978a9af230c5ae65e0c23f77ccc98f59e2a7a5d3eff0c73de0aab0c1b5863bea
SSDEEP 12288:aK6DrM+A8HaedwQBfr7n1AylQ5zzzlhHGNdY/:R6DoCVwK36B5HmI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11870

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

FIVEM-ESCROW-BYPASS-main/bypass.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3e4288b32006fe8499b43a7f605bb7337931847a0aa79a33217a1d6d1a6c397e
MD5 8df4d6b5dc1629fcefcdc20210a88eac
SHA1 16c661757ad90eb84228aa3487db11a2eac6fe64
SHA512 874b4987865588efb806a283b0e785fd24e8b1562026edd43050e150bce6c883134f3c8ad0f8c107b0fb1b26fce6ddcc7e344a5f55c3788dac35035b13d15174
SSDEEP 6144:iYOMWAEq+PAEwGQ9Xivs0s4EtS1Fv8jnLKdFvkPo2:AG+PpjQSHv8jA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

289950

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\Users\Max\Desktop\lib\cecil-master\obj\net_4_0_Release\Mono.Cecil.pdb

FIVEM-ESCROW-BYPASS-main.zip

FIVEM-ESCROW-BYPASS-main/FXServer.exe

mscoree

dotnet

FIVEM-ESCROW-BYPASS-main/LICENSE

FIVEM-ESCROW-BYPASS-main/README.md

FIVEM-ESCROW-BYPASS-main/bypass.dll

mscoree

dotnet