bypass[.]exe | Triage™

General

Target
bypass.exe
Size 211KB
Sample251220-2pcgqsymgr
SHA256 ff0ffae4478f831cf64714f734a4f8fcf4d6c81ddfcf43e37aa026566970882a
MD5 dc1926e90476c49859e8649f3b678f1c
SHA1 7d8d8af0dddf80d921b1d440a6ee3bbbd4e6b016
SHA512 befb94daea7e39fdb07e468fb4c666bf225ccb8d74a8cf00d14c751f00ccdd6a8a50956d3f8f529d5c2df6340037439a6d5f248d39c0a0035e91c55afd569f86
SSDEEP 3072:WAD+0yxRNhJFk4swBYCa4IMMgcjzc092Px0VgIV3hhgJlhavYchw90:W0ixpJWRwBYtfcRp03V3hhgJlhkBw
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bypass.exe

File Explorer

bypass.exe

.exe 211KB

bypass.exe

IMPHASH ceb6f018622d2a5df2b9b9a07d0c4584
SHA256 ff0ffae4478f831cf64714f734a4f8fcf4d6c81ddfcf43e37aa026566970882a
MD5 dc1926e90476c49859e8649f3b678f1c
SHA1 7d8d8af0dddf80d921b1d440a6ee3bbbd4e6b016
SHA512 befb94daea7e39fdb07e468fb4c666bf225ccb8d74a8cf00d14c751f00ccdd6a8a50956d3f8f529d5c2df6340037439a6d5f248d39c0a0035e91c55afd569f86
SSDEEP 3072:WAD+0yxRNhJFk4swBYCa4IMMgcjzc092Px0VgIV3hhgJlhavYchw90:W0ixpJWRwBYtfcRp03V3hhgJlhkBw
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

5952

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateToolhelp32Snapshot Sleep Process32NextW Process32FirstW CloseHandle OpenProcess VirtualProtectEx DebugActiveProcess ReadProcessMemory Module32NextW VirtualQueryEx WriteConsoleW DebugActiveProcessStop GetCurrentProcess Module32FirstW WriteProcessMemory RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW RaiseException GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW CompareStringW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW

advapi32

AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueW

Name

.text

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

500.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

115KB

Virtual Size

114KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

bypass.exe

kernel32

advapi32

generic