uacbypass[.]exe | Triage™

General

Target
uacbypass.exe
Size 239KB
Sample261107-pyfvasx12j
SHA256 726bb5a656b9654a565f48cd50c66466ca5aa7a1239c01c142fbeeeb74564d36
MD5 d83b8b68c9026a00c3fa9a9384dd9e02
SHA1 a769f1b90a1722aa671600bd6b80897e6f47d38e
SHA512 469ba6b44cf03a565f7b8208f479c952b841d426c50ce7aec42188f6ad51fb86c9d86c8dfe9363cb54675a9439f68209033890bdb49ba70d3e9fea800c9df2c4
SSDEEP 6144:jCwBTAD+OdilebYLeSdSd6jK+EKhjJEzvzuxu:/j0d6++XdJEHuxu
TLSH
T115345B46F29549FDE9B786BDCD918901EB727C0607B0D6DF079049A21F23AD0AE3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
uacbypass.exe

File Explorer

uacbypass.exe

.exe 239KB

uacbypass.exe

IMPHASH bc8d531df0081e7f86733a71dfd28318
SHA256 726bb5a656b9654a565f48cd50c66466ca5aa7a1239c01c142fbeeeb74564d36
MD5 d83b8b68c9026a00c3fa9a9384dd9e02
SHA1 a769f1b90a1722aa671600bd6b80897e6f47d38e
SHA512 469ba6b44cf03a565f7b8208f479c952b841d426c50ce7aec42188f6ad51fb86c9d86c8dfe9363cb54675a9439f68209033890bdb49ba70d3e9fea800c9df2c4
SSDEEP 6144:jCwBTAD+OdilebYLeSdSd6jK+EKhjJEzvzuxu:/j0d6++XdJEHuxu
TLSH
T115345B46F29549FDE9B786BDCD918901EB727C0607B0D6DF079049A21F23AD0AE3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

58908

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ole32

CoGetObject CoInitializeEx CoUninitialize

advapi32

RegQueryValueExW StartServiceW QueryServiceConfigW OpenServiceW OpenProcessToken GetTokenInformation LookupPrivilegeNameW RegCloseKey RegCreateKeyExW RegDeleteValueW RegOpenKeyExW EnumServicesStatusExW RegSetValueExW RegDeleteTreeW CloseServiceHandle CreateServiceW DeleteService OpenSCManagerW

user32

SendMessageTimeoutW

kernel32

SetEndOfFile WriteConsoleW HeapReAlloc HeapSize CreateFileW CreateDirectoryW DeleteFileW GetFileAttributesW GetShortPathNameW GetTempPathW CloseHandle GetLastError WaitForSingleObject Sleep GetCurrentProcess GetCurrentProcessId CreateProcessW GetTickCount GetTickCount64 GetSystemDirectoryW GetModuleFileNameW CopyFileW MultiByteToWideChar WideCharToMultiByte SetConsoleOutputCP ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW TerminateProcess QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead FlushFileBuffers RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetFileType ReadFile GetConsoleMode ReadConsoleW GetConsoleOutputCP GetFileSizeEx SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle GetStringTypeW

Name

.text

Size

159KB

Virtual Size

158KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

65KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

uacbypass.exe

ole32

advapi32

user32

kernel32

generic