BypAI.zip
- SHA256 2b4e3692a542d1bad5cd2386caac14c32f177793dbe5c046c1b446a0b179b100
Behavioral task
behavioral1
Sample
BypAI/BypAI-Client.exe
Resource
win11-20260513-en
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
| resource | yara_rule |
|---|---|
| static1/unpack001/BypAI/BypAI-Client.dll | costura |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/BypAI/BypAI-Client.dll |
| unpack002/costura.dll |
| unpack002/imgui.net.dll |
| unpack002/nativelibraryloader.dll |
| unpack002/newtonsoft.json.dll |
| unpack002/sharpgen.runtime.com.dll |
| unpack002/sharpgen.runtime.dll |
| unpack002/sixlabors.imagesharp.dll |
| unpack002/veldrid.dll |
| unpack002/veldrid.imagesharp.dll |
| unpack002/veldrid.metalbindings.dll |
| unpack002/veldrid.openglbindings.dll |
| unpack002/veldrid.sdl2.dll |
| unpack002/veldrid.startuputilities.dll |
| unpack002/vk.dll |
| unpack002/vortice.d3dcompiler.dll |
| unpack002/vortice.direct3d11.dll |
| unpack002/vortice.directx.dll |
| unpack002/vortice.dxgi.dll |
| unpack002/vortice.mathematics.dll |
| unpack001/BypAI/BypAI-Client.exe |
| unpack001/BypAI/runtimes/win-x64/native/SDL2.dll |
| unpack001/BypAI/runtimes/win-x64/native/cimgui.dll |
| unpack001/BypAI/runtimes/win-x86/native/SDL2.dll |
| unpack001/BypAI/runtimes/win-x86/native/cimgui.dll |
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Oct 16, 2017
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Oct 16, 2017
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Oct 24, 2025
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=259, version=35207,
count=13, id=260, version=35207,
count=86, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33145,
count=212, id=1, productName=Unmarked objects,
count=10, id=265, version=35223,
count=1, id=258, version=35223,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=23, id=259, version=28900,
count=160, id=261, version=28900,
count=19, id=260, version=28900,
count=10, id=259, version=34321,
count=15, id=260, version=34321,
count=38, id=261, version=34321,
count=9, id=257, version=28900,
count=107, id=1, productName=Unmarked objects,
count=6, id=261, version=34435,
count=1, id=256, version=34435,
count=1, id=255, version=34435,
count=1, id=258, version=34435,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=34, id=259, version=28900,
count=163, id=261, version=28900,
count=26, id=260, version=28900,
count=23, id=259, version=34321,
count=16, id=260, version=34321,
count=35, id=261, version=34321,
count=9, id=257, version=28900,
count=99, id=1, productName=Unmarked objects,
count=6, id=261, version=34435,
count=1, id=256, version=34435,
count=1, id=255, version=34435,
count=1, id=258, version=34435,