bypass windows defender[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
bypass windows defender.zip
Size 71KB
Sample260831-tw6edshd99
SHA256 3af1fa09cc0d2c5c03b568900720006cfe04f31d9cf760b2c0b56d599d9d43fc
MD5 5c6b77a7ad23e8ef5575bbcac0b703e5
SHA1 599d7b0add846e3eadfb02d923c44aa04590d50f
SHA512 767d64fdc1660d33240f0d404d36fd056d214b8618f14c6353292c617dfc61a141172d1528a111c7fe95138de881e80c93da4f2bbe394271cb9323f42821d707
SSDEEP 1536:8oXmz5xY0WCD/VUutzQ/ymjNO9rGyYnXUpbnoIn2Y:8M65xY29tU6F9HuXUpbnoInR
TLSH
T185730274267A36B4D27B642B33277F0A3F6350192F489BB809112344E1F9E7978297DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/bypass windows defender.dll
unpack001/bypass windows defender.exe

File Explorer

bypass windows defender.zip

.zip 71KB
bypass windows defender.dll

.exe 5KB
bypass windows defender.exe

.exe 158KB

bypass windows defender.zip

SHA256 3af1fa09cc0d2c5c03b568900720006cfe04f31d9cf760b2c0b56d599d9d43fc
MD5 5c6b77a7ad23e8ef5575bbcac0b703e5
SHA1 599d7b0add846e3eadfb02d923c44aa04590d50f
SHA512 767d64fdc1660d33240f0d404d36fd056d214b8618f14c6353292c617dfc61a141172d1528a111c7fe95138de881e80c93da4f2bbe394271cb9323f42821d707
SSDEEP 1536:8oXmz5xY0WCD/VUutzQ/ymjNO9rGyYnXUpbnoIn2Y:8M65xY29tU6F9HuXUpbnoInR
TLSH
T185730274267A36B4D27B642B33277F0A3F6350192F489BB809112344E1F9E7978297DB
MD5 SHA1 SHA512 SSDEEP TLSH

bypass windows defender.dll

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 c657e67eef3432536a6afe57fa40c469d2a14ee20338433442d68eca1719e0a6
MD5 0072825d04fe97a7ad4cf5c84d3016a7
SHA1 4b45fafb007f1bde6612d7b375f522ba9b9dcc29
SHA512 05a2d239ff928a72801a501a5ede2927ed6d8d82822b1160cadbc2376543ebc201eaebe3bdd71bde1afbe814c16460394a6d4fd8d18a6aa3e462fa433affa73d
SSDEEP 48:6/atsGn4WKUVIChImtsHB9UweYQDlT6PvW0W0vDIl6BgSL4vpfbNtm:ljn4WKUVamtG9UweYIZLcBGBzNt
TLSH
T1F8B19700A7D5C336E5B74F32FABB67061675BA664E2687AE24C44223AD13725CD23B70
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10482

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\root 1515\source\repos\bypass windows defender\bypass windows defender\obj\Debug\net10.0\bypass windows defender.pdb

bypass windows defender.exe

IMPHASH 53e4e12437621212a425d294842d0a96
SHA256 49f455bc62157f974e6227e357f43dced2bf0c9a6ad54cef0ee8beab06a3e13d
MD5 4ae11d5679707cc752ea75d0c54b8bd0
SHA1 0fbb00d838e2bcf01094f88e075978d52cdec8fa
SHA512 5b7367071ca92baecac1c987e9a1bf759ae8563b84bdb340efa0cc6eec17778fb77fbc125e3de360f31a5671c3c0cf1051b4f6be9ef42c6b9b30f115bae28506
SSDEEP 3072:AVDxk88wN1nLVu7dL1Z9QnlX9rE38wm1VzaAT5f2:sHRu7F1nQnZ88UI
TLSH
T176F33C13A6A851BEE1B3D678C9924941FB7278594B71A7CF03504EBA0F77BD09E39302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

80800

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\src\runtime\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb

shell32

ShellExecuteW

advapi32

RegCloseKey ReportEventW RegisterEventSourceW RegOpenKeyExW RegGetValueW DeregisterEventSource

kernel32

TlsFree CreateActCtxW ActivateActCtx GetLastError FindResourceW GetWindowsDirectoryW GetProcAddress GetModuleHandleW FreeLibrary LoadLibraryExW FindFirstFileExW EnterCriticalSection GetFullPathNameW FindNextFileW GetCurrentProcess GetStdHandle GetModuleHandleExW GetModuleFileNameW LeaveCriticalSection GetEnvironmentVariableW FindClose GetFileAttributesW MultiByteToWideChar GetConsoleMode GetFileAttributesExW LoadLibraryA WriteConsoleW DeleteCriticalSection WideCharToMultiByte IsWow64Process OutputDebugStringW GetCurrentProcessId TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW SwitchToThread GetCurrentThreadId InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime

user32

MessageBoxW

api-ms-win-crt-runtime-l1-1-0

terminate _register_thread_local_exe_atexit_callback _c_exit __p___wargv __p___argc _exit exit _initterm_e _errno _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table abort _invoke_watson

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc malloc _callnewh free

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64_s wcsftime

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfwprintf __p__commode fputwc __acrt_iob_func __stdio_common_vswprintf _set_fmode _wfsopen fflush setvbuf __stdio_common_vsnwprintf_s

api-ms-win-crt-locale-l1-1-0

_create_locale ___mb_cur_max_func ___lc_codepage_func ___lc_locale_name_func __pctype_func _configthreadlocale setlocale _lock_locales _free_locale _unlock_locales

api-ms-win-crt-string-l1-1-0

strlen strcmp wcsncmp toupper strcpy_s _wcsdup wcsnlen

api-ms-win-crt-convert-l1-1-0

_wtoi wcstoul

api-ms-win-crt-math-l1-1-0

__setusermatherr