Real_Unprotected_Bypas[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Real_Unprotected_Bypas.exe
Size 11.2MB
Sample260905-kvcagsch79
SHA256 e53bea590eeff6457cbc4154780256fa7591c7d122fb27c0b1d57554031ea190
MD5 0c501d951558017bde57c26c0d67fb56
SHA1 bcdc1bac46647da78a66965b8197d6ce2dd15928
SHA512 ca07b851b87ca27fe0f5e176917259bca9f3598c6b10b101ed883dce2ab9e967b8fe0902423142072be0b4de60ddbdddd5ababb3a17d901789d27a4a7ca2c18d
SSDEEP 196608:o60OSsiUw4vYhHopk1MVnMYwcXpFcBDtsr92Pc4wW6MV4Cm488G:oBSjvSopPPwspiLshK53VLG
TLSH
T125C6AFE730C2A59DC902C5FFC753BC7FCB9FB036061AA9A36118B2669917C507A14F29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Real_Unprotected_Bypas.exe

File Explorer

Real_Unprotected_Bypas.exe

.exe 11.2MB

Real_Unprotected_Bypas.exe

IMPHASH 42ae7523f8af32cfefea86564ee01b35
SHA256 e53bea590eeff6457cbc4154780256fa7591c7d122fb27c0b1d57554031ea190
MD5 0c501d951558017bde57c26c0d67fb56
SHA1 bcdc1bac46647da78a66965b8197d6ce2dd15928
SHA512 ca07b851b87ca27fe0f5e176917259bca9f3598c6b10b101ed883dce2ab9e967b8fe0902423142072be0b4de60ddbdddd5ababb3a17d901789d27a4a7ca2c18d
SSDEEP 196608:o60OSsiUw4vYhHopk1MVnMYwcXpFcBDtsr92Pc4wW6MV4Cm488G:oBSjvSopPPwspiLshK53VLG
TLSH
T125C6AFE730C2A59DC902C5FFC753BC7FCB9FB036061AA9A36118B2669917C507A14F29
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

294816

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CloseHandle CreateFileW CreateToolhelp32Snapshot DeviceIoControl DuplicateHandle ExitProcess GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetFileType GetLastError GetModuleFileNameA GetModuleHandleA GetModuleHandleW GetProcAddress GetStdHandle GetSystemTimeAsFileTime GetTempPathA InitializeSListHead IsWow64Process LoadLibraryA LocalFree Module32First Module32Next OpenProcess OpenThread Process32First Process32Next QueryFullProcessImageNameA QueryPerformanceCounter ReadFile ReadProcessMemory ResumeThread SetUnhandledExceptionFilter Sleep SuspendThread SystemTimeToFileTime Thread32First Thread32Next VirtualAllocEx VirtualProtectEx VirtualQueryEx WriteFile WriteProcessMemory

advapi32

AdjustTokenPrivileges ConvertSidToStringSidA LookupPrivilegeValueA LsaClose LsaFreeMemory LsaOpenPolicy LsaQueryInformationPolicy OpenProcessToken RegGetValueA

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0_Lockit@std@@QEAA@H@Z ??0ios_base@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1_Lockit@std@@QEAA@XZ ??1ios_base@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??7ios_base@std@@QEBA_NXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ??4?$_Iosb@H@std@@QEAAAEAV01@$$QEAV01@@Z ?do_encoding@?$codecvt@_SDU_Mbstatet@@@std@@MEBAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?do_encoding@?$codecvt@_SDU_Mbstatet@@@std@@MEBAHXZ ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?uncaught_exceptions@std@@YAHXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

wininet

InternetTimeToSystemTimeW

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptFinishHash BCryptGenRandom BCryptGetProperty BCryptHashData BCryptOpenAlgorithmProvider

ncrypt

NCryptCreatePersistedKey NCryptExportKey NCryptFinalizeKey NCryptFreeObject NCryptGetProperty NCryptOpenKey NCryptOpenStorageProvider NCryptSetProperty NCryptSignHash

crypt32

CryptBinaryToStringA CryptStringToBinaryA

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption

iphlpapi

FreeMibTable GetIfTable2Ex

vcruntime140

_CxxThrowException __C_specific_handler __CxxFrameHandler3 __current_exception __current_exception_context __std_exception_copy __std_exception_destroy __std_terminate memcmp memcpy memcpy memset strrchr

ucrtbase

__p__commode __stdio_common_vsprintf_s _fseeki64 _get_stream_buffer_pointers _set_fmode fclose fflush fgetc fgetpos fputc fread fsetpos fwrite setvbuf ungetc __p___argc __p___argv _c_exit _cexit _configure_narrow_argv _crt_atexit _errno _Exit _get_initial_narrow_environment _initialize_narrow_environment _initialize_onexit_table _initterm _initterm_e _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type exit terminate _lock_file _unlock_file _stricmp isspace isxdigit strcmp strcpy_s strlen strncmp tolower wcscmp wcslen _time64 _callnewh _set_new_mode free malloc _strtoi64 strtoul __setusermatherr _configthreadlocale

Name

.text

Size

286KB

Virtual Size

288KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

41KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

692B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tuffshi

Size

6.8MB

Virtual Size

6.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Name

.SCY

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

Real_Unprotected_Bypas.exe

kernel32

advapi32

msvcp140

version

wininet

bcrypt

ncrypt

crypt32

winhttp

iphlpapi

vcruntime140

ucrtbase

generic