Static task
static1
Behavioral task
behavioral1
Sample
Bypass.dll
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Bypass.dll
Resource
win10v2004-20240709-en
General
-
Target
Bypass.dll
-
Size
34KB
-
MD5
af8248c9aefa381d3a24ffdc512d403d
-
SHA1
0f345ab291c1176eacf04560113ebb7a599f3c5d
-
SHA256
1e66a94c9e2adc42e6465b7c0b42a17218c22bd18cf7d95ca08258dddf9ca48e
-
SHA512
52bed741d575cba438286c9f09d0ee1eb494b060477cbbfe856d6cf32d1a15a171b7fee27147e86b5a4a33c083bf987f7e8871513d1bd74f7ee4ae176f7f6f92
-
SSDEEP
768:DwH+eNqxtStyYTw+V5bdbrcf+yOABn+e:UeaqxtStyOwEtsTVX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Bypass.dll
Files
-
Bypass.dll.dll windows:6 windows x64 arch:x64
2fe94f37aa92afda532703d10f61e753
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
lstrlenW
GetModuleHandleA
LoadLibraryA
GetProcAddress
lstrcmpW
LoadLibraryExW
RtlLookupFunctionEntry
RtlCaptureContext
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
RtlVirtualUnwind
user32
ShowWindow
vcruntime140
__C_specific_handler
memcpy
__std_type_info_destroy_list
memset
api-ms-win-crt-runtime-l1-1-0
_cexit
_initialize_onexit_table
_execute_onexit_table
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
_initialize_narrow_environment
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 504B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ