HANBOT BYPASS[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

HANBOT BYPASS.exe
Size

1.3MB
MD5

edc4502afb8fe9f9db9565b4460d749a
SHA1

321c2fb030e35fc755d7f5974e7be36e4add087c
SHA256

b4ecb063f56fab630f9c5ca899df0a01d854de8cee8d50708fda3f6ea74da108
SHA512

68545c2932e942ac5eac8a96a126b009147e88f88720c6e9d546898c081075ec3f33ac16b37dfb6ee77bea025929d3df2910777a887f2c328fc254fc6c236c1f
SSDEEP

24576:b4kW5njIxmAAfb3GDZwU855nnGNrU2YflC0TmxVnxse6Iiqdpjg:8kEl/bqZ9g5UTaZ6vnt6IiqP8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
HANBOT BYPASS.exe

Files

HANBOT BYPASS.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1019KB - Virtual size: 1019KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 265KB - Virtual size: 265KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ