9�q �QeI��W+�1����a;I4��?W��n��T����l �1���;6�����6����K�{~A�Z��?�«��ȬQ������S[5rz~�5�B�|&AZ���g�qZ ݱ/J�3�|D�]��)���M4�GnŬ f���t ?e����NCzK��7�|i w�����{L���;�< �� �Uh��* �;����$���c3A�HA��FC$� �&.��`�$G�-�`�=�û����<���n�x�@��h���r*�D{��e�\ʿ�I˄"��:��� �Hz:Y���:%X�2�ǫ�����6��� �q�0K����E������$E�����n7#ש���O7��ʚ�r�4�����e,�����v�$��h����2��5�L�p�Jד2�?w�y䶞F�HHm���UW�� �poIJ�nH��9�]��B��!&;х�{[L��1��@���?�1Դ�PѺ��t�uLmBi����dF��2�R�ژWQ$��P&e,��@�v�/J��bzG~��]�d�Al���7���dӾ��^FM$2�m���o�N���-����[�4xh�ָv��t�+�w?aɺnYo2��c�#���K��f�(�j�YP-�_u#Q<��i��&K??ik!]'�������P�M��s��@\U���9�/c�:�MU5B����>����!˗-! �/?f[�G�����l�ᶝπ�4zC3�eE��E�d����cM#�C���ɼ��`�_����7/�+?-��]l��R���|�L�sVG2�&ـ�H'yȓ'�o=&z����ė2�Ǚ2��s��C|\�{C�R�_ o��v�����Sypᤌ��#C�!'Q^��Կ��iR7 +�4]8_N�3.p�u��+��@x�J�`JO;8cr�}�A���y��.���+�^�������o�"R�����rf��f�2��<#��B�$^��)�]�6�Iơ`x�C��L\�ҿ(�ޖ��̊�դ/4['���j���6Q=�z������ߛy}��Z����b��5��mz��t��up�Q�䂿�T�|����O�''7��**�l|�ZDs^��S�K�郟����P��S����ܕ���Y��wJ����,� 0���`�Fi.F��ٲy��`q�N3K���S퀡�e��k�"W���Z<��{��|�;h��P�|;$�>��m���R�M_���g��Qū��l�X��q��74��&��N^���&9�Z���ے_ ǖa�Z�~P�.j�"�m�?N���٢%Vz������#�]J�-CP�&��%�vz�(�h/��f�� ����`�6 O0TS=e��u^s��:�I�*��R�x���3/�������~�ߤ'�i8��`�oj<j߆���-�њc�ܭ���G_"����U�ּ��i��B>F6����n��={m�����* T)E���j��61e���� ���C�D+����C@~q���F�O�L�%�o�F&�DY��k�ʆͶu��n/2�8�U � %�4Ʒ�Y��hF�Z�=�J����M�2}�45�&~���-R�6���$Ѧn���*����aG{#B.����-�k���`������3+_*#���uJ\�FLk3�����/T�;�kx-��G�?'�.a�'���+>����G�ۭXj����$c �y�f��Q�~��߱��(L" �I�D��lc�g������@@��#�D�Ss��x�ug�(C,]��!֥��w: �- ��������� ��U�?zzgh�OX��(����vB�ve|JY���龻��Ք��ࡵ[��� ��� ���@�&�~ā�f��g�ݨ�_��J�d�!Cծ�iM�d �ys�t�d��Wh:3P,L"˰����f / ��3`M��F�;�v��߅�����Ք'ڻ&�O��,|z�%�V�a�W"U���\0����I�ի�D^��6���s?l��B]<:���TF43��iO���(�T-� ���,�-� |� u�/�wb�?W � (�Y�{D�r�,��R�XmUh���Bt�0�1���1�@��.(�_�ҎFV����El���h�f�*j����QWώV ���� u����.��G(B������z�ՠ�7E���zt1�T�����X��5g&_"���0+y���1vx7v�D�l$�x%\i��W��<�A�U[����X�}�$���ު�#y�^����˘����9�O��g��g�EZIwZ�#�XT �`��F�:M��O�A�R����p�WvOۈ����G�|v� �����mѷ66�P�Y�F\ꝵ�Fʦ]��M{��t�3����́&��H��G�c��o�mH��TPV�<��G�l��*8%UW~+�J����0��P�ߦ�}i���m�>�=�<`j�k���Mc��Q}!��>��R���ɾ�P�X�A2p�7��fz�]Ss�D\0�,S;���(Ef�8<�����%�Lg�?�V���~��Α��9h��|VVaQ�-(�{�K� �S� |%��&���J���p4�ߡ�3�����2���՝f ��!���d�p~����L�l����g��y�Y6����� �������Y�<�A��Y�c��/��`p��k�$9��Sm��G3 ��C2����Jl3�9���b"�*aȦh����(l�='�*�ىe�m�-�B>����M�3B��GnK�ʂS*�R{X�m����&�"�ݼct}�������pȍ�MS0��V���(�qF�y���ſ�ɲ+����M�"��G..FS�j%I�1AM�������x ��`ӑ�;<��%3�~6��q���w=K �^���j'�!�%4�w{.UIH5gS��iVp ��QF���sE�/��k3h��U_���������`g1�.��ѣ�N�`��?�3ʍuӻat* 35vf��2[~.nqC��;M��t,L]V��h��O�@��*q&|�N��z�S�����u�~k�MIi90t��盪b�7�=����w8�L}PYh�� ��!�R{"�� 9INzy��o���D��{�����~\i���j�JP�%Q|�^�=�:�4���e��HŅ�'�Z|��^74�mJ�
Static task
static1
Behavioral task
behavioral1
Sample
1Loader Bypass VIP 3.4.exe
Resource
win10-20240404-en
General
-
Target
1Loader Bypass VIP 3.4.exe
-
Size
42.5MB
-
MD5
095811a3ff713ea73d9be2bdc38d8750
-
SHA1
969e04775b1dbb3fc0a6a90f68e78b2e9de92d83
-
SHA256
b3d35a1101faf4536fec869ad74436ff2a0ad927afa6665f694f0d0e4a19867d
-
SHA512
ddb9db16eae1d8aad38b3a79b643045a9a10f65e67958f01339974163b232b67f55d51030be23e84acdc2ecfd328ce889e71737cd0806d8ac3bc6982df779d4b
-
SSDEEP
786432:gIcEi8sZejA8Y9LcWdRYEtwEEABcplMJZLkvBB2BgTTAnP3LqYh:O8VG9LPjtwENBcpuJkzybP3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1Loader Bypass VIP 3.4.exe
Files
-
1Loader Bypass VIP 3.4.exe.exe windows:6 windows x64 arch:x64
3904e343e3ef3b27569cc8bb77c30bb7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileInMemory
kernel32
GetProcessId
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ReleaseDC
CharUpperBuffW
gdi32
CreateRectRgn
advapi32
RegSetValueExA
shell32
ShellExecuteExA
msvcp140d
?__ExceptionPtrRethrow@@YAXPEBX@Z
wtsapi32
WTSEnumerateProcessesW
normaliz
IdnToAscii
wldap32
ord200
crypt32
CryptQueryObject
ws2_32
htons
imm32
ImmGetContext
dwmapi
DwmGetColorizationColor
httpapi
HttpCreateUrlGroup
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140d
__std_type_info_destroy_list
vcruntime140_1d
__CxxFrameHandler4
ucrtbased
__stdio_common_vsprintf
Exports
Exports
Sections
.textbss Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 949KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 133KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.msvcjmc Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 777B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: - Virtual size: 337B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.>ep Size: - Virtual size: 64.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.oDd Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.d0w Size: 42.4MB - Virtual size: 42.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 71KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ