TPM_bypass[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

TPM_bypass.exe
Size

516KB
MD5

710746839f623a829fdea356397cfdae
SHA1

375d435a419263fb2e49993b5efa1449cd515b23
SHA256

0b6767b567e963ca3e886da1fdbbca2bd891dc2f4826cc3eccfc64f76a504476
SHA512

8770dbc8aa86b69118a53fa36864e078d380719deb590336e222615999ff082a1fe2372030d7da78a640bad95d996466ab60ca77aee9d8275735586754484262
SSDEEP

12288:52jUaqLBsP3x42lxYENrFdsffmwKQlGtEmc/hu:0nqtsfC2YENRK+EKEv/h

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TPM_bypass.exe

Files

TPM_bypass.exe
.exe windows:6 windows x64 arch:x64

cb5b4e6c568d424c61939b08a4fe8769

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Administrator\Desktop\RoverCheats\RoverCheats\RoverBypass\x64\Release\TPMBypass.pdb

Imports

kernel32

GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
CreateFileA
GetFileSizeEx
WideCharToMultiByte
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
FreeLibrary
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetSystemDirectoryA
QueryPerformanceFrequency
VerSetConditionMask
SleepEx
MultiByteToWideChar
EnterCriticalSection
FormatMessageA
SetLastError
LocalFree
CloseHandle
GetCurrentProcess
GetProcessHeap
DeleteCriticalSection
HeapDestroy
HeapAlloc
HeapReAlloc
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetModuleHandleW
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentVariableA
WaitForSingleObjectEx
MoveFileExA
GetTickCount
QueryPerformanceCounter
VerifyVersionInfoA
LoadLibraryA
GetProcAddress
LeaveCriticalSection
GetSystemTimeAsFileTime
GetModuleHandleA
GetLastError
HeapSize
InitializeCriticalSectionEx
HeapFree
GetConsoleWindow
SetConsoleTitleA
SetConsoleTextAttribute
SetConsoleScreenBufferInfoEx
GetConsoleScreenBufferInfoEx
SetConsoleMode
GetConsoleMode
Sleep
RtlLookupFunctionEntry
GetStdHandle
InitializeSListHead
OutputDebugStringW
ReleaseSRWLockExclusive

user32

SetWindowLongA
MoveWindow
GetWindowRect
GetWindowLongA
MessageBoxA

advapi32

CryptEncrypt
GetTokenInformation
GetLengthSid
OpenProcessToken
IsValidSid
CopySid
ConvertSidToStringSidA
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey

shell32

ShellExecuteA

msvcp140

?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?id@?$ctype@D@std@@2V0locale@2@A
?_Xbad_function_call@std@@YAXXZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ
_Cnd_do_broadcast_at_thread_exit
?_Throw_Cpp_error@std@@YAXH@Z
??Bid@locale@std@@QEAA_KXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Random_device@std@@YAIXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

urlmon

URLDownloadToFileA

normaliz

IdnToAscii

wldap32

ord33
ord46
ord35
ord27
ord26
ord22
ord41
ord32
ord45
ord60
ord211
ord217
ord143
ord79
ord30
ord200
ord301
ord50

crypt32

CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertOpenStore
CertCloseStore

ws2_32

ntohl
gethostname
sendto
recvfrom
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
ioctlsocket
listen
htonl
accept
WSACleanup
WSAIoctl
WSASetLastError
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
bind
WSAGetLastError
send
recv
closesocket
WSAStartup

userenv

UnloadUserProfile

vcruntime140

__std_exception_destroy
_CxxThrowException
__std_exception_copy
memchr
__std_terminate
memcpy
memmove
memset
__C_specific_handler
__current_exception_context
__current_exception
memcmp
strstr
strrchr
strchr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_initterm_e
__sys_nerr
_errno
_invalid_parameter_noinfo_noreturn
exit
strerror
_invalid_parameter_noinfo
_getpid
system
_beginthreadex
terminate
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
_c_exit
_get_initial_narrow_environment
_resetstkoflw
_initterm
_exit
__p___argv
__p___argc

api-ms-win-crt-heap-l1-1-0

calloc
malloc
_set_new_mode
realloc
free
_callnewh

api-ms-win-crt-utility-l1-1-0

rand
qsort

api-ms-win-crt-stdio-l1-1-0

feof
fseek
__stdio_common_vfprintf
__acrt_iob_func
__p__commode
ftell
__stdio_common_vsscanf
fputs
_read
_write
_close
_open
_set_fmode
fopen
_lseeki64
fgets
fclose
__stdio_common_vsprintf
fflush
fread
fwrite
fputc

api-ms-win-crt-convert-l1-1-0

strtoul
strtol
strtoull
strtod
atoi
strtoll

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
localeconv

api-ms-win-crt-time-l1-1-0

_time64
_gmtime64

api-ms-win-crt-string-l1-1-0

strncmp
strpbrk
strspn
strncpy
strcmp
_strdup
strcspn
tolower
isupper

api-ms-win-crt-filesystem-l1-1-0

_unlink
_access
_fstat64
_stat64

api-ms-win-crt-math-l1-1-0

__setusermatherr
_dclass

Sections

.text
Size: 399KB - Virtual size: 398KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cb5b4e6c568d424c61939b08a4fe8769

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

msvcp140

urlmon

normaliz

wldap32

crypt32

ws2_32

userenv

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

Sections

.text Size: 399KB - Virtual size: 398KB

.rdata Size: 96KB - Virtual size: 95KB

.data Size: 1024B - Virtual size: 3KB

.pdata Size: 17KB - Virtual size: 17KB

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 399KB - Virtual size: 398KB

.rdata
Size: 96KB - Virtual size: 95KB

.data
Size: 1024B - Virtual size: 3KB

.pdata
Size: 17KB - Virtual size: 17KB

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 1KB - Virtual size: 1KB