��a���;�p�b��I�wq��~��4�����Av7�����4�ԭ��{AG?�t��y��kB����3.�FX�g�v�.G����Y=U+�:P�6ZCG��(uS��*P�&Cw���8ǯRA����x =l7Y )�9��8�b���>j��K��`�,RA'7y��E�<t9�7>t�FiQ`����[?�X��� �A��Q-�8p�qV�m�f�H5w$E�n[rm�V�c��P��,��[~�E@�ɜ���*�~��\܇/�q�x�]�F�A�xd�<L<@؎�:,Q�AM���Wg��I�����3�����vpb&����:����_��,f��ߚ� ��L�m5� ���:��y�[��'��o<� B����K��Y�= � ��|A-t��Ε�'����EdJ53�︊#���ЧK��� rf��A"��.%��q�Wb���e�QM\�`����yǛlM�qϒ���I6Ş�Z�s���3�x/D��� �`ժ�E���h ț�qԎP$s*��%z�h��G�t/+��7 h��"�P�����6lt-a��ǰR���Te����1�X n<�=Z�����?�t2������~�g �d�y�줾�I��96��j��\s�&/]��H#�Z�&k�,p�����.{�~�t�z�E��,.���P��x#�Ⱥ��7��� ��K#��u���� �Հ�s\�d����[���f�/Q,�Ժ�Y�KG!U�XCm�$���<���(��$����u���~)Hw��BA3�ۤ[-(>�/�̮e��mK�|D�r`e(�G�-�{����oAp�6/L-�- �Q_�z����^'���M�'j���nQ]���8f`�V����--����f��Lt��Z��8���b����%�ZO�ʐ̷���xv*��F�F��Z ��V;�mK}�;��F#����c�G�`�6��^�yq�F|�7_ �U�5�c�H[l�pߺ+�l���������]���L���!~j+u�zUڜn��^Z4/��\I��#Z&"}�����Z������`d��9�k���� BZ�4�plyxBv|��K��5�'uo�?+L�I{8�0�"�GN;9K��G��ۼˎ��������N�_>h�t�B���X����6d}����w��g;��s����2s�ov�x5���������S}r��o��;{9�:m�[377�z�4٭��J��H�"�u�ad��CNJ�x¾@m�%���7��A�o�4qŏU��{3i����osZ�GXly)TI����JZ�a��rr@�F���� �� ~��[�QZ�p�C�*ow!�v�Υ4����R��C-jv���OR�+�=�7օ�%�)s*2 �QŸ\�[��Z�J�f Nԟ|��}��Aj/���å;�|�.�p��-��[OGF0��d!>�mUr��U�o<��ĭ��(>�F���H���d��ٸ9�����fP$�#ff��� �(i2*#r$P���� � �ڵk�,����m_0J~�0��e�![�X�)[K_���0��i���Yc�,�|SiK����ʏ`���7I��|��]�]�ROT�me���xN�!���%h/����sPl(�@�յSȭi]EIQ����j�$)�C���3[Ɉ�{Uer�/�=���Tf�ޅe����c��P��*]�Ow>�3�\J̲��*J�ք�>"F�U*ص���{����N� ���.-5���Q�fn(�j���^��>�q��@�oI�Nn�eU (5�g��7�5�92�z�����KC�Ү2Z̭���v뙌��� ?Of�2�3t��!�1�um1��$�E���n���I�~�:_�C��:֓���>X�~|GGV�J2uE#m�K̈z�����U��2�T����S�2f\��6bi���=�F2hh�"/f��0ߊ� ������@�:�.*Ptu��<������L��@@9��B`�O���E�������p n��: C�k�(�<��Ȏ\��}a�*s��A~�j�!�c!�J�W�އ���r\҂�*m4D٣X���(���iB��YPW�>C��.���:?��6�+v�-�կ ЊM���xj\� a�ҁ�t09Sp�3�� #��f\%�L�OC�%@%X��@�q�&W\T�D���a��E�O��Q��"Ht"�����-��po�4�N ���B��6��o�_Mٍ�����������:�4��������f\��QRO�C!a�� ���Ԟg�*�% �+C�� ]2ܚ�n#�q�U�NÝX,¥�)T������?��e���z�bsR[��%�!e'7����A��D���*����_؞<:u�#�'~J��_\-�V^��d-���z)��?����?sT��+ ���=�t����}bO��)v` ���4Јg���2x�P-`68_���`�7��Q����!������yڛ=7D LӼ�h���.�CRt�Bz�����HS]�+`n"�q5.*�~��c����O�ӌb�����^v�)�{�`��䨣DB3�Ca�D�z[�L��Q����8�w<eD��&#���#Ģ�:���ң���Q� �`���bi�e+�)�V@���8F�{w�[�5�*�dcR����"�A�W��0؆�+C��ȭ�&��pt�Țɽ껨�tcHu������0��vj2�v@�s+#h�����i��"$��[b�4DU�G�G\�]���;���'��`�-Ԏ�aE��GP+�8�$ ���1eϾjFt�����@�E�fD���gA`�"ۛx� ��R�X�^��6܃��P<קU"Y��Yr��5�.Q�K�Aq������]����Z��QZNK_J2g��&j��D�]���<,���I�Z�v��6��ц�o��RDKLQ|�#�O����[nr.�K��|W�Dm�]�,������r��w]X��*|�~�K���_��� ���"+��x��(q��t���J���3���D��\���<��,��`�TM#�1����~ؐ3K�.A���R�]m���o'5�V�X���@F=�I&
Static task
static1
Behavioral task
behavioral1
Sample
1BYPASS PUBGMOBILE FREE.exe
Resource
win10v2004-20240802-en
General
-
Target
1BYPASS PUBGMOBILE FREE.exe
-
Size
41.7MB
-
MD5
3e0d24cca7f626fda64efd81731e6e8c
-
SHA1
8ab13ff8c4a78221bc360be01f02fb491c952f19
-
SHA256
5e54c0229e796f00d8ae06cb0c55192cd66a2d595591904eec3d12693d59c587
-
SHA512
5904dc19cceaad2d1a708562b72d4ac1a39cc4da18783c45caf1659e9c8afcfc23628c5d1fdb3d0f0b775d0c4a58d2c96264c7c556991818fae34b03abe0cbb9
-
SSDEEP
786432:R/EHJfqhQH0Q/RKarv0Gs3rjrY9TGaySkzXEeKO+elDywVuuRDp:4Jfsc0QZKw0GmcItTQeKORbuuR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1BYPASS PUBGMOBILE FREE.exe
Files
-
1BYPASS PUBGMOBILE FREE.exe.exe windows:6 windows x64 arch:x64
Password: 1
5591053a7a7d164ca54b326b4f029203
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileA
kernel32
GetProcessId
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ReleaseDC
CharUpperBuffW
gdi32
CreateRectRgn
advapi32
RegSetValueExA
shell32
ShellExecuteExA
msvcp140d
?__ExceptionPtrRethrow@@YAXPEBX@Z
wtsapi32
WTSEnumerateProcessesW
normaliz
IdnToAscii
wldap32
ord200
crypt32
CryptQueryObject
ws2_32
htons
imm32
ImmGetContext
dwmapi
DwmGetColorizationColor
httpapi
HttpCreateUrlGroup
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140d
__std_type_info_destroy_list
vcruntime140_1d
__CxxFrameHandler4
ucrtbased
toupper
Exports
Exports
Sections
.textbss Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 949KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 133KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.msvcjmc Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 777B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: - Virtual size: 337B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.~*> Size: - Virtual size: 64.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Lv Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.IXp Size: 41.5MB - Virtual size: 41.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 265KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ