Bypass[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Bypass.exe
Size

204KB
MD5

ace682bbaa7fa6fde13efc969a9c5861
SHA1

081fb164c21b5a53d6455d9170afa634174893f6
SHA256

decf29b82801fccf67c4a45ea1fa3877c6968693146eca34299e2f4fd7f104f7
SHA512

d31cb58442b21bf7e38b889e102878f58c7f2a02d647a5371ec99ef68bdc7313cf8682d1eba5d5bbb7d424d54a9c7412590bb4c159232f7100c7c86577516bc0
SSDEEP

3072:eE0d+NHQUiVaHm7aod6TJ4BF2wzAQerG1OFJ25M0d+NHQUiVaHm7aod6TG:3NQUVGBM14BTfcFJ46NQUVGBM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Bypass.exe

Files

Bypass.exe
.exe windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Administrator\Downloads\92VSX0r\ni ker\Bypass\obj\x64\Release\Bypass.pdb

Sections

.text
Size: 202KB - Virtual size: 201KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ