��Ģl�s�[��[{a�TG`�������."��Y���н]$�9�JГ>�3pI�kMSa1�� ���;�P�Q;���Ƕ��9X;�)V��~�ȣ���́��$��WL,p�2E_���8e"��B9���+�ݷ�{�f�@e�l�mYk����[;����{���Ԛ�UeS٦jt�b̳#s�����]7����L_9MsHl��b�0��Će���<��.��gΜE �,A��[�_�����v_�H{j��M�e��w�C�31ßnA���7��I�a��J-���2����n��H2�A�d1�Qޡ�"��<���[����D�I�[J�(���k+�)&gQ���0��_���qS̛c;}�L�t�_�)%�~���a@7�GO��!�[֑�\M'P$�`���r!�-ؼ���7�!6����o흲�/��Z!�:����V�z?Q4��'����L��W�(��[�]��<���O�X��fL˳��QC�eZW�}��O��Ղ;%u3��g����#خ��+�n�@cP��������f��xwĬ�*�;��5x�H ;:��� � ��~V2�Cl��`H� K��FH�nV��>�$[-.%�4�� ��������hd}�Fm$��h��8`��;���ن(,\ �#x�绉wÁiwK+��_TI� ��bǷe��ao �v��I��v<��_�� ry�ԓ����f�-�T�"�����U�U>�D�(f��S_�|�;�;��}�㜥 ���k��w�V?U2Z���Y���[�HEbhq��7û�_�x�(�}]I�Lj���w�Ӧ4|�/�K�H��z���ߦ5�EL�"o큟�����a���;�4Tt���UA�[}��G��㓸 ��ۂ3�$E���dJ� ��<6Y�Si �M�s7��g.wǒ:�9v�TpZ��p]<H���g+X��~���.@a3��/ڳޘڱg,����*j~WLQ�&)�G˲��0��a�x�d*��x@��;�{@ʝ��@���H�Nj�C����A��`��J�( c�M�Ǘ!�D���Un6='��c�^��q�P�Fa/��`cOB�a;���P"�>]��{!���_�(�`�zF3Dxj['ў'4��x�����ڌe�m}� �0{�iƪ�2>0�cC��2hE@;$��E�y�;���Ѐ�^%�@̎1�존�8��en#�x�IH�B��=��D%�h��ͻ�X����~��%P�i����h<���EP�zs��i����=#|��I��}zY����f�k1�l�J�V�L����Tv�k��˞��#lhq�x�e$]l�����_#��-j��R�d&�b0ϴӊsp퓳.6L�L�V��T�U�Q(�h�����B�ڈ��}�q��D�KVa�Fܰ[ޡ�2ɂa�1��e���(��c,�dx���5Ogч<Q�#� f���gk�?d].� �.an�_zaSm��H���̌0�J��!���b�:���2l���N��5�x�P}f.�%�U/GV���ʛDJvC����3����߂�/��ڨ_z�)�.�Ij+������TZ��;E��ȈRW��d��JG����V�!��Ei�7��*.KQ�Au�=Ku�+�`<� �@�P�@����Z~���4��D�q���Y��G-�Ԩ> d~`�@&�l���[ e�A? �鄘�����tR��MO��6*'p~��N#��E[-���8���{��0�A��w6�)/$6I8����a]tǛ�˚fn'�o&YW����Z�h�Ʉ�r`����֝� ��H��]6�[�"������c P �~��2iZ�&�jE���ը�v��L�*�W���/s�C���4�1pA8�'��s�3��P�5�v�Mf�7��y8-/���f�<�ڂlV����ȴ��m�5������ [i �# ����5�$qND���;�7��Z��l ����Ro�j��:@���*rv6DM�H��y�d�h�n�*����A�y��?z���go���J(ފ�c�i���/]��;�c4��Trac��JtSL��A�%����7B'h���n<�l<��+>����G�/�j�Mqq�(�����]��}%����盽��LZ�5@,����̘|�:I|������䅉�����j�����{����M:�]Nl"a�4�q&��W�Q���sV��O�r%��a�ADFo�yT?�s�{ę��F�c�ӂ���!����x ZN�������kM�ͤ��k9�s��`� ι� p/������� y�2������� �|���٢JF`nbKAXg}kίz�6ԋ�$5�%oH�浆]������� ����jW}��F:��3c�tK�\F�H! Tk!�t[�9��Cw+N\硩��̉���ه��C؉M��g=���*�m|�ә����/J��ġ�u��\��3)=`Q�B����o�/��p<�G�e%p���}1��&K��zv1p%'�� ܤb���"1� ��X��'(�]BP����(p���#�.��� ǖ���>bl�$�AX2R�S��!��k�_��_Y�"/J~��jH�����8�38Q�o-<��u�I-�X�� *�Gg�]ި�_��!���Q� �����$��\�S>%�E@\�4�b0X�iW��X��E\�f�����'t�`���M��B��{c��ˉ�*�>.ލ���H.����zB?i�Hؘ�G�o� ��$l���Nk˺]��E���}ԬCPl]IXF���w!=�'�L�i�ܖ�M���E� Wȩ��bap���{bq�V|�zƴ�����~���3�_Z��C��I;]��4��3��P�� KJ���j�n�8ֹa�o���ݢƓL�P><cn؇G�[z�b�>�9��ّJ�D���GAp���)8Ts�#��x�L�"�o��ϸ��n��̹p�|�$4���b�C�s�H��6�I��?R����X� D��>��9ʅ��U�|��H���mVe�[�L� P{�_{.������r�a�x;H� Z.�~�p�
Static task
static1
Behavioral task
behavioral1
Sample
1Bypass102 3.3.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral2
Sample
1Bypass102 3.3.exe
Resource
win11-20240709-en
General
-
Target
1Bypass102 3.3.exe
-
Size
43.1MB
-
MD5
39ccf946d8a08abb795ae32e2841dfe4
-
SHA1
ee2cdaf449a39d4c9a93d29a99c0c65ae4354cba
-
SHA256
debf6a91173da0aa1b23a7d06a8add086349b64d37b8c35e9d55b97497cb69c3
-
SHA512
aa3e5f089883cff7ce1fa2ad30289ab033d305180676abe41b6fd80ad6c483e2393c3bcdc93ece0f7f86e4f190b1b62ac72d7fc09ba4facb1437605457089adb
-
SSDEEP
786432:qa9+OhKdhL6g6c1jCLYFgjXxZsV1tf1fWxcJt9d/1LuRSBUY:MfHGSexZsV1zLnpcS2Y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1Bypass102 3.3.exe
Files
-
1Bypass102 3.3.exe.exe windows:6 windows x64 arch:x64
675231ece730c79fa2f39ffc06c3f169
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetVersionExA
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
d3d11
D3D11CreateDeviceAndSwapChain
user32
SetWindowTextA
CharUpperBuffW
gdi32
CreateRectRgn
advapi32
DeleteService
shell32
ShellExecuteExA
ole32
CoInitializeEx
oleaut32
SysAllocString
msvcp140d
?__ExceptionPtrRethrow@@YAXPEBX@Z
normaliz
IdnToAscii
wldap32
ord22
crypt32
CertFreeCertificateChain
ws2_32
ntohs
d3dcompiler_43
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
imm32
ImmSetCandidateWindow
httpapi
HttpSendHttpResponse
psapi
GetModuleInformation
userenv
UnloadUserProfile
gdiplus
GdipCloneImage
urlmon
URLDownloadToFileA
wininet
DeleteUrlCacheEntryA
vcruntime140d
__current_exception_context
vcruntime140_1d
__CxxFrameHandler4
ucrtbased
powf
Exports
Exports
Sections
.textbss Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 969KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 865KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 190KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.msvcjmc Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 777B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: - Virtual size: 337B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
. P4 Size: - Virtual size: 64.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
..KN Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.e"g Size: 43.0MB - Virtual size: 43.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 232B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 81KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ