mfa bypass[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
mfa bypass.exe
Size 105KB
Sample260929-r2laastxcs
SHA256 9dab893421cdfda06063b57a815e3f2a5a3625c1756c3879a1cda4bae3250c22
MD5 6b39f1906ab136a52e0841933584f319
SHA1 b975910ba68529c863a587915b32321803c6bbc2
SHA512 f3e5412b0ccd7907be1e7fcd9de44683dbb1daf76180d9f178109b809ee75ccd183a531240514e8f8ba6831c4f492e3f6c692857feea150102dab4df193228f4
SSDEEP 3072:cXik2ICCNx6+A1Nx6GawlnsuTNMvpKmqpj:cXEICCv6++ad05TCxKmS
TLSH
T18EB34C2AAF1601B6D255D6B8CE935902DF727C5A47A167CF23D04EE60E23AD06F3E701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mfa bypass.exe

File Explorer

mfa bypass.exe

.exe 105KB

mfa bypass.exe

IMPHASH 08b648f31fbd66f6367040b24c9438ab
SHA256 9dab893421cdfda06063b57a815e3f2a5a3625c1756c3879a1cda4bae3250c22
MD5 6b39f1906ab136a52e0841933584f319
SHA1 b975910ba68529c863a587915b32321803c6bbc2
SHA512 f3e5412b0ccd7907be1e7fcd9de44683dbb1daf76180d9f178109b809ee75ccd183a531240514e8f8ba6831c4f492e3f6c692857feea150102dab4df193228f4
SSDEEP 3072:cXik2ICCNx6+A1Nx6GawlnsuTNMvpKmqpj:cXEICCv6++ad05TCxKmS
TLSH
T18EB34C2AAF1601B6D255D6B8CE935902DF727C5A47A167CF23D04EE60E23AD06F3E701
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

64612

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

ReadFile GetFileSizeEx GetEnvironmentVariableA MultiByteToWideChar Sleep GetTickCount64 GetLastError CreateFileA CloseHandle SetFilePointerEx AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead ReleaseSRWLockExclusive

msvcp140

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?tolower@?$ctype@D@std@@QEBADD@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z _Strcoll ?id@?$collate@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xbad_alloc@std@@YAXXZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z _Strxfrm ??1_Lockit@std@@QEAA@XZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ

wininet

InternetOpenA InternetReadFile InternetConnectA HttpSendRequestA InternetCloseHandle HttpQueryInfoA HttpAddRequestHeadersA InternetSetOptionA HttpOpenRequestA InternetQueryOptionA

winhttp

WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpSetOption

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove __current_exception_context __current_exception __std_exception_destroy __std_exception_copy __std_terminate strchr memcmp memcpy memset __C_specific_handler _CxxThrowException

api-ms-win-crt-heap-l1-1-0

_callnewh realloc free _set_new_mode malloc

api-ms-win-crt-stdio-l1-1-0

fgets _set_fmode __acrt_iob_func __stdio_common_vfprintf __stdio_common_vsprintf_s __p__commode

api-ms-win-crt-runtime-l1-1-0

_cexit _exit __p___argv exit _crt_atexit _register_onexit_function _initterm_e _register_thread_local_exe_atexit_callback terminate _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _initterm _invoke_watson _get_initial_narrow_environment _seh_filter_exe _set_app_type _c_exit __p___argc

api-ms-win-crt-string-l1-1-0

_stricmp

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale