mfa bypass[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
mfa bypass.exe
Size 1.2MB
Sample260910-tmng8adq41
SHA256 8b0bdc48f9b6f16861253516459a0229fdc785bf7609a99483d177abe1fb891f
MD5 f24e32c2017e7ba09d4ca8aeebada5f6
SHA1 f06017fa63e7d48908e97a045c942d0b613334d7
SHA512 7f0fc288d8673e775deeb5d4cd14202a8893d4d0318a2ae43cc761418935454c9f006366c671a690ab4024fb6829e7e4df4b97c87266678e2a12a1bb281b21ce
SSDEEP 12288:li8gTcZTXnbsqO0vzmEl3O0vzmElFO0vzmEleO0vzmElPO0vzmEliO0vzmEl:TnbsqFzz3FzzFFzzeFzzPFzziFzz
TLSH
T18E45D006EF97059DE0BFC4B9D9A664B7E2B1740E43D0DDDB2A8096730E729A06B3DD10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mfa bypass.exe

File Explorer

mfa bypass.exe

.exe 1.2MB

mfa bypass.exe

IMPHASH 0de4f0d647e6e45459a513d102504461
SHA256 8b0bdc48f9b6f16861253516459a0229fdc785bf7609a99483d177abe1fb891f
MD5 f24e32c2017e7ba09d4ca8aeebada5f6
SHA1 f06017fa63e7d48908e97a045c942d0b613334d7
SHA512 7f0fc288d8673e775deeb5d4cd14202a8893d4d0318a2ae43cc761418935454c9f006366c671a690ab4024fb6829e7e4df4b97c87266678e2a12a1bb281b21ce
SSDEEP 12288:li8gTcZTXnbsqO0vzmEl3O0vzmElFO0vzmEleO0vzmElPO0vzmEliO0vzmEl:TnbsqFzz3FzzFFzzeFzzPFzziFzz
TLSH
T18E45D006EF97059DE0BFC4B9D9A664B7E2B1740E43D0DDDB2A8096730E729A06B3DD10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1111552

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

ReadFile GetFileSizeEx GetEnvironmentVariableA MultiByteToWideChar Sleep GetLastError CreateFileA CloseHandle SetFilePointerEx GetTickCount WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead ReleaseSRWLockExclusive AcquireSRWLockExclusive

msvcp140

?_Xlength_error@std@@YAXPEBD@Z ?id@?$collate@D@std@@2V0locale@2@A _Strcoll _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Xbad_function_call@std@@YAXXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBADD@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z __crtLCMapStringA ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Id_cnt@id@locale@std@@0HA ?_Xbad_alloc@std@@YAXXZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Throw_Cpp_error@std@@YAXH@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Strxfrm ?id@?$ctype@D@std@@2V0locale@2@A ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z

wininet

HttpOpenRequestA InternetCloseHandle InternetReadFile HttpAddRequestHeadersA InternetSetOptionA HttpQueryInfoA InternetQueryOptionA InternetConnectA InternetOpenA HttpSendRequestA

winhttp

WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpReceiveResponse WinHttpCloseHandle WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect WinHttpSetOption WinHttpQueryDataAvailable

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __current_exception _CxxThrowException __C_specific_handler memset memmove memcmp memcpy __std_type_info_compare __RTtypeid __std_exception_destroy __std_exception_copy __std_terminate strchr

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc _callnewh realloc free

api-ms-win-crt-stdio-l1-1-0

getchar __stdio_common_vsprintf_s __p__commode _set_fmode __acrt_iob_func __stdio_common_vfprintf __stdio_common_vsprintf

api-ms-win-crt-convert-l1-1-0

strtoll strtod atoi strtoull

api-ms-win-crt-runtime-l1-1-0

_set_app_type _get_initial_narrow_environment _initterm _initterm_e exit _exit _seh_filter_exe __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _cexit _configure_narrow_argv _errno _register_onexit_function terminate _initialize_onexit_table _beginthreadex _initialize_narrow_environment _crt_atexit

api-ms-win-crt-locale-l1-1-0

localeconv ___lc_collate_cp_func _configthreadlocale ___lc_locale_name_func

api-ms-win-crt-string-l1-1-0

_stricmp strlen

api-ms-win-crt-math-l1-1-0

_dclass __setusermatherr

Name

.text

Size

132KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1017KB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

mfa bypass.exe

kernel32

msvcp140

wininet

winhttp

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

generic