bypass[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
bypass.exe
Size 1.3MB
Sample260716-e2nzzacz5r
SHA256 c8a4d2b721925c313f6add4c9d9d9519cc1adf5e7ba65432e945804ac90ec764
MD5 cd37c51f5517746bae492122a88f4e45
SHA1 5a6fd663ede67dfd391d6494934770692e6fed54
SHA512 1b8e9e395f4e4ca8560e8cbd5eee6875e50d7ad755c60252dcbc91c94a4975ee0f5cae3e4ab7b0f1ce4d21fcf869d6315f6a6d2611dccfbf33dee60611af294f
SSDEEP 24576:clB+NwBI8hBbUBc3UGpQFCfHAxK2Yy3AqjYWL30ZezVqxJh1:cnMNibUsVpQFCfAxKm3AqnL306q/h
TLSH
T1D8559D07A54B58ACD09BD9B8436B5902DB21744B4736FCEF11CA95B72F3B2E48B39702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bypass.exe

File Explorer

bypass.exe

.exe 1.3MB

bypass.exe

IMPHASH 20bd56d6976ab471050f760a73844d98
SHA256 c8a4d2b721925c313f6add4c9d9d9519cc1adf5e7ba65432e945804ac90ec764
MD5 cd37c51f5517746bae492122a88f4e45
SHA1 5a6fd663ede67dfd391d6494934770692e6fed54
SHA512 1b8e9e395f4e4ca8560e8cbd5eee6875e50d7ad755c60252dcbc91c94a4975ee0f5cae3e4ab7b0f1ce4d21fcf869d6315f6a6d2611dccfbf33dee60611af294f
SSDEEP 24576:clB+NwBI8hBbUBc3UGpQFCfHAxK2Yy3AqjYWL30ZezVqxJh1:cnMNibUsVpQFCfAxKm3AqnL306q/h
TLSH
T1D8559D07A54B58ACD09BD9B8436B5902DB21744B4736FCEF11CA95B72F3B2E48B39702
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

857472

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Berke\Desktop\bypass\x64\Release\bypass.pdb

fwpuclnt

FwpmFilterAdd0 FwpmSubLayerAdd0 FwpmEngineClose0 FwpmEngineOpen0 FwpmFreeMemory0 FwpmGetAppIdFromFileName0

advapi32

SystemFunction036 CryptReleaseContext CryptDestroyHash CryptGetHashParam CryptHashData CryptCreateHash CryptAcquireContextA RegCloseKey RegOpenKeyExA RegQueryValueExA RegSetValueExA OpenProcessToken GetUserNameA AdjustTokenPrivileges LookupPrivilegeValueA

winmm

midiOutClose midiOutShortMsg midiOutOpen

ws2_32

setsockopt closesocket WSACleanup WSAStartup ntohs

gdi32

CreateCompatibleDC SelectObject BitBlt DeleteObject DeleteDC CreateCompatibleBitmap

user32

IsWindowVisible ReleaseDC GetDC GetSystemMetrics GetWindowThreadProcessId MessageBoxA GetWindow GetWindowTextA GetTopWindow EnumDisplayDevicesA

kernel32

GetCommandLineA GetCommandLineW WriteFile GetModuleFileNameW FreeLibraryAndExitThread ExitThread GetModuleHandleExW ExitProcess RtlUnwind LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc GetStdHandle FindClose FindFirstFileW FindNextFileW CloseHandle WaitForSingleObject CreateProcessA GetConsoleMode SetConsoleMode SetConsoleCtrlHandler SetConsoleTextAttribute SetConsoleTitleA CreateToolhelp32Snapshot Process32FirstW Process32NextW HeapAlloc HeapFree GetProcessHeap IsDebuggerPresent QueryPerformanceCounter QueryPerformanceFrequency GetCurrentProcess TerminateProcess GetCurrentThread GetThreadContext GetModuleHandleA GetProcAddress CompareStringW GetCurrentProcessId CreateThread GetCurrentThreadId OpenProcess GetTickCount GetModuleFileNameA CreateFileA GetFileSizeEx ReadFile GetModuleHandleW GlobalMemoryStatusEx GetDiskFreeSpaceExA GetTickCount64 VirtualQuery GlobalFree GetComputerNameA Sleep GetFileAttributesA CreateProcessW Process32First Process32Next GetVolumeInformationA VirtualProtect RaiseException SetLastError OutputDebugStringA GetLastError InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetSystemInfo VirtualLock VirtualUnlock HeapSize CreateFileW LCMapStringW GetLocaleInfoW IsValidLocale SetEndOfFile SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP RtlUnwindEx GetACP IsValidCodePage FindFirstFileExW RtlPcToFileHeader InitializeSListHead GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers WriteConsoleW GetConsoleOutputCP SetFilePointerEx ReadConsoleW GetExitCodeProcess GetFileAttributesExW LoadLibraryA WaitForSingleObjectEx GetExitCodeThread WideCharToMultiByte InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeCriticalSectionEx DeleteCriticalSection FlsAlloc FlsGetValue FlsSetValue FlsFree GetSystemTimeAsFileTime EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW HeapReAlloc

ole32

CreateStreamOnHGlobal

iphlpapi

GetTcpTable2 GetAdaptersInfo GetAdaptersAddresses

gdiplus

GdipDisposeImage GdipSaveImageToStream GdipGetImageEncoders GdiplusShutdown GdipCreateBitmapFromHBITMAP GdiplusStartup GdipGetImageEncodersSize

winhttp

WinHttpGetIEProxyConfigForCurrentUser

Name

.text

Size

987KB

Virtual Size

986KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

179KB

Virtual Size

178KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

105KB

Virtual Size

127KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

bypass.exe

fwpuclnt

advapi32

winmm

ws2_32

gdi32

user32

kernel32

ole32

iphlpapi

gdiplus

winhttp

generic