Static task
static1
General
-
Target
VANGUARD BYPASS.exe
-
Size
2.5MB
-
MD5
2473c143b9591080093561cd3fc42955
-
SHA1
3a65083c411edba6b7a5dcdb93a2bebcc410e95b
-
SHA256
89ee1cbd0ef4390b420dea55744487665d4bf7dcfa2c2597db2984dfad5dff1a
-
SHA512
ae599014de20c34d0b75d938f743dc443b37bbd5095ec4f24548f9cff5a08f48a7959eae0dea070cf5d43d6916a4affe8ff1d825f5d8ab2907f00a9df5a5c334
-
SSDEEP
49152:pXkQq9LDj26Mx1zrHvxx5qaXqQ7hsaNsRBt87lOpSJnQxnDNZGZ8VpDTU2:pXkQqxD8NrHxhXqosaNO8JOY+6OVlU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource VANGUARD BYPASS.exe
Files
-
VANGUARD BYPASS.exe.exe windows:6 windows x64 arch:x64
baa93d47220682c04d92f7797d9224ce
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
lstrcpy
comctl32
InitCommonControls
Sections
Size: 325KB - Virtual size: 712KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 3.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
bhqgvnff Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
gkokrkao Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 22KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ