Free Uid Bypass[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Free Uid Bypass.exe
Size 4.4MB
Sample260804-bc9zcss1hw
SHA256 2a429597015cdff17fab1d8179abb4872924c0757ffcb84e73bc72769d4c9e16
MD5 f38b75756790aaa07a68690a1bfa5835
SHA1 9bc3146e69af7fc9892c13774571f8e7f89b931f
SHA512 c7b491bb4339a6207534317d77343913a3f9ea629786a0663ccae274dec91cbf10091ef6b84feeefd6c69600558c4ac6f1031e73221febf19c6030cbe5775b6f
SSDEEP 98304:VygzExpd8GlANHqoWmElndX7Sl5YdmI7EfUkVA7xiUafpl:Vw4GlANHqoWmEp0l6/7EMkVA7Qp
TLSH
T1E726DF47B3A602ACC16791388797D327E77274051B21A3CB73A0C6A55F53AF06E7B782
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Free Uid Bypass.exe

File Explorer

Free Uid Bypass.exe

.exe 4.4MB

Free Uid Bypass.exe

IMPHASH b50e7f2d3032e7a5b68a2b325815724d
SHA256 2a429597015cdff17fab1d8179abb4872924c0757ffcb84e73bc72769d4c9e16
MD5 f38b75756790aaa07a68690a1bfa5835
SHA1 9bc3146e69af7fc9892c13774571f8e7f89b931f
SHA512 c7b491bb4339a6207534317d77343913a3f9ea629786a0663ccae274dec91cbf10091ef6b84feeefd6c69600558c4ac6f1031e73221febf19c6030cbe5775b6f
SSDEEP 98304:VygzExpd8GlANHqoWmElndX7Sl5YdmI7EfUkVA7xiUafpl:Vw4GlANHqoWmEp0l6/7EMkVA7Qp
TLSH
T1E726DF47B3A602ACC16791388797D327E77274051B21A3CB73A0C6A55F53AF06E7B782
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1561416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\UpakuL SRC ALL WORKING\lol\lol\lol\x64\Release\Uid Bypass.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

kernel32

InitializeCriticalSectionEx DeleteCriticalSection CreateThread VirtualProtect CreateFileMappingW GetModuleFileNameA QueryFullProcessImageNameW SetLastError FormatMessageW ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSection EnterCriticalSection LeaveCriticalSection LocalFree GetSystemDirectoryW LoadLibraryW SleepEx GetSystemInfo MoveFileExW WaitForSingleObjectEx GetStdHandle GetFileType WaitForMultipleObjects VerifyVersionInfoW HeapFree VerSetConditionMask HeapSize GetCurrentThreadId GetTickCount64 FormatMessageA GetLocaleInfoEx GetCurrentDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW HeapReAlloc HeapAlloc GetFileSizeEx CreateFileA QueryPerformanceFrequency WriteProcessMemory GetLocaleInfoA GlobalUnlock WideCharToMultiByte GlobalLock SetFileInformationByHandle GlobalFree GlobalAlloc MoveFileW CreateRemoteThread HeapDestroy FreeLibrary CreateFileMappingA UnmapViewOfFile MapViewOfFile SleepConditionVariableSRW GetProcessHeap GetModuleHandleW VirtualAllocEx DeleteFileW SetFileAttributesW OutputDebugStringA GetTickCount GetExitCodeProcess CreateProcessA GetProcAddress Process32FirstW Process32Next QueryFullProcessImageNameA Process32NextW Sleep CreateToolhelp32Snapshot OpenProcess GetModuleHandleA WaitForSingleObject GetEnvironmentVariableA CreatePipe TerminateProcess AddVectoredExceptionHandler GetCurrentProcess OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WakeAllConditionVariable CreateDirectoryW Process32First MultiByteToWideChar GetModuleFileNameW lstrlenW WaitNamedPipeW GetCurrentProcessId CloseHandle GetLastError CreateFileW PeekNamedPipe WriteFile ReadFile LoadLibraryA QueryPerformanceCounter GetFileInformationByHandleEx AreFileApisANSI

user32

SetClipboardData GetAsyncKeyState EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos ReleaseCapture GetClipboardData GetWindowLongW IsWindowUnicode DefWindowProcW DispatchMessageA GetWindowRect DestroyWindow CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow MessageBoxA MoveWindow SetLayeredWindowAttributes TranslateMessage SendMessageA LoadIconA SetWindowLongW PeekMessageA PostQuitMessage UpdateWindow GetKeyState GetClientRect SetCursor SetCapture GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient LoadCursorA GetMessageExtraInfo

advapi32

SystemFunction036 RegSetValueExW RegCreateKeyExW RegCloseKey CryptImportKey CryptEncrypt CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW ConvertSidToStringSidA CopySid SetSecurityInfo OpenProcessToken AddAccessAllowedAce GetLengthSid GetTokenInformation InitializeAcl IsValidSid RegCreateKeyExA RegDeleteKeyA CryptDestroyKey

shell32

ShellExecuteA SHGetKnownFolderPath

ole32

CoTaskMemFree

msvcp140

?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?tolower@?$ctype@D@std@@QEBADD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ??7ios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?_Random_device@std@@YAIXZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ _Thrd_detach _Strcoll ?_Syserror_map@std@@YAPEBDH@Z ?id@?$collate@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xbad_function_call@std@@YAXXZ ?_Winerror_map@std@@YAHH@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xbad_alloc@std@@YAXXZ ?uncaught_exception@std@@YA_NXZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Strxfrm _Cnd_broadcast _Mtx_unlock _Thrd_join _Query_perf_counter _Thrd_id _Cnd_do_broadcast_at_thread_exit _Mtx_lock ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency _Xtime_get_ticks ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ

version

GetFileVersionInfoSizeA VerQueryValueA GetFileVersionInfoA

psapi

GetModuleInformation

crypt32

CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertGetCertificateChain CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFindExtension CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CryptStringToBinaryA CertFreeCertificateChain

ws2_32

ntohs gethostname ioctlsocket sendto recvfrom freeaddrinfo getaddrinfo listen htonl accept htons select __WSAFDIsSet inet_ntop connect setsockopt socket getsockname WSAStartup recv inet_pton closesocket getsockopt send getpeername WSACloseEvent WSACreateEvent WSAEnumNetworkEvents bind WSAEventSelect WSACleanup WSAResetEvent WSAWaitForMultipleEvents WSASetLastError WSAIoctl WSAGetLastError

iphlpapi

GetAdaptersAddresses

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

dwmapi

DwmExtendFrameIntoClientArea

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

wininet

HttpQueryInfoW InternetReadFile InternetOpenW InternetOpenUrlW InternetCloseHandle

shlwapi

PathFindFileNameW

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__intrinsic_setjmp __C_specific_handler __current_exception_context __current_exception wcschr _CxxThrowException memcmp memchr memset memmove memcpy longjmp strrchr strchr __std_exception_copy __std_exception_destroy __std_terminate strstr

api-ms-win-crt-runtime-l1-1-0

_wassert _beginthreadex terminate _invoke_watson _invalid_parameter_noinfo_noreturn _errno exit system __sys_errlist __sys_nerr abort _register_thread_local_exe_atexit_callback _c_exit _invalid_parameter_noinfo _exit _initterm_e _initterm _get_narrow_winmain_command_line _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _resetstkoflw

api-ms-win-crt-stdio-l1-1-0

fgetc fwrite __acrt_iob_func _wopen fgetpos setvbuf feof fputs ungetc fsetpos _set_fmode __p__commode fread _fseeki64 _read __stdio_common_vfprintf _popen _pclose fgets _write _fileno _close _lseeki64 _get_stream_buffer_pointers __stdio_common_vswprintf ftell fputc fseek fflush __stdio_common_vsscanf __stdio_common_vsprintf _wfopen fclose

api-ms-win-crt-time-l1-1-0

_difftime64 _localtime64_s _time64 _gmtime64 _localtime64 strftime

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh free malloc realloc calloc

api-ms-win-crt-string-l1-1-0

strncmp strncpy_s strcmp _strdup _wcsdup isdigit wcsncpy isspace strcspn wcspbrk strspn wcsncmp strpbrk tolower strncpy

api-ms-win-crt-filesystem-l1-1-0

_fstat64 _unlink _unlock_file _wstat64 _lock_file

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

strtoull wcstombs strtol strtoll strtod strtoul atoi

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-math-l1-1-0

cosf __setusermatherr ceilf fmodf acosf sqrtf powf _fdopen sinf _dsign

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func localeconv