]�Z���2)�W�s�1�-dNhI>U��4d)���Y�.?���ɮ�Z��f�Џ˦������t�����-�V'@S��wI����⺵��s��O�,N�����Kz�r�4��ǐ#~�O������:��J�ˊ�C��y~��NS�3�"R!�-?������"��nKO��KsC=�L����(J'u���վ��<u㢁4���S�5[؟��|3�6����p8[ �zGg>�%J�'h+Bq����땿���}מߥ�s��-2��2���]��x�ݰ�j;���ܲ�����V���j��C������L3E�=����"�$Y�f���e�B*�dͪf�tM���d\5oF��{M���U�\���l^��I�A!��9 :t����Z���b�l"fm��o!ɮK��u�9엪�+Dn��.�����}l���d��F�j��T�������r�c�6��� 1���(t����1�n=�}N��Bz��"�+����_i��+y�`���=[�ĉ�����^w�) m+g���[��i�4��T�7ᦏX�Y�������ϥ<NN$��/�o��������g���0��V���4�lB��("Y3�BFRJ������=.j���+H��a� �����,Qfv�C�?no`g5��Z9]�Fa�g��I�x������)�x}��e�9\��C{��n����sɳ@FA��̮�yb0��q>�0k�svW�C�850��,乡Ϛ�7Q�;��85���'��y�v�хD��(��%YO��ٗ�0[�^�KJ���R����������C����o�m�ؿ,{ARڰ�vzD�g�9���>���=�䎯���Pg�j��E��� �A�.�T�&^1��8��P�Q�����O �t��ah���P�� ;�`"5ТJ�u���~�C���UD��:��\������3�P��@U�ڜ���r�Z!�+冀�I /v���FV��@ٕl��V��-t1O�!�H�f}G~�'��7p��d�Rҵ+ܐ�fAN��Tzt�"�d�EZ���P �����_��8n�8��yΜ'ϵ|-��GȔj�1ص @�G�h��[oJCPG5`8�>��ĥ���k+�r箞���5FG1��X��1>y�/;GN�䳇1S�n�Gv4*<q���g�<�� 9 �#���ҟ�#8������GE��b�GI8�M�p����y�՜�Jd��k�f�K��<>9)��W[x�:����[G�K �φ�{�`Nx��uL�Q��g�� TC��8_�Ō�%|$��8��(+�!���B%�O]�q(���$�Q�YЊ�N�c͒@e��1p]� Y�����C2�8ƤU�)��һ�%�l��@p����P�y�@G������f�4��|���l�!Y݃��?���KP�0S9ӷ��t�53/Z��7��*�V ��Ȣn�E�]�z���@��N�XZ�n�b!��<pTlyì� �75[zn^)�mJS��������Cv��U���T���j%!�4��21t��P@Tb:FKWc⚵�]RR�g� k��/r��~b-�#������0���5��c�4U��~���ΩN�ċ�~�J��ʸT'@|����CIT���^�ʇ�̞-d�� m��,�{ 7<��$6�)4�A�y�D�(���Y�"�_[���ƶt��T2yr���ną� c�z��nŇ9� �ҙ�.<��_�>B�*��}@f����81��?�� a#λ%��$�.����r�%'�<�ܱtS�}8�*��/tِ����G,�b�G�(�`�s�NM|�ã�îI�$'��k��4���S�� �ӯ���� �hmv=T�m���f&�J�7�P�)/���)��P��g��r��m`٬��jX�dX���"�7��v�E���{*�M+r'���%��Z]u�j��jT_(pE������.�v��Ŝ.;ȓ������\zJ����]$ԚEF��M�4��U��l���0�Y�������s�<��xG']@4�k��'�� i:� ��3�+�{#��i�h�0ˉ����ܹ2������j�(Vt���ɸL��bTB�t"sRW�q�m�i���7Y��$8z���Z<Q6�#�pߐ%���-x[�'5xHb�"�����7wB���D�mB!I7^�t�uYV����B���E�i�]X����ˉ`��~��qY "2E��.2�S>No�V���̳��6��>t�N�7L�K�g����_DTQ�ȎԳL0G��L�j2�������ė��|�s�$K�q�.&F�)|xR�-3�6RH�c�+T���܉����?�:�@(�e�����"�o/��j�?����R]._�����K��c���S�,��uaL�(Jˬ=F�,��N;�k-�������`wK���iUIQ�������kf�nH�hFɀ� �ы~�a@�mh/��o�*��2�ߠ�D��ΦE0*���ȕ�ANg�� (mV��s��8(#�������y�ז�ѻ�z���͋�k�����g���?>SZ���8bƇ�z�d\��d�U����Swϙ&�:|Ww�6I<yj��z`ЗR0le���\��Az4K���C�栏�R�]���b�n%9#�і�D�I�r/q:�����Q�^N=��`�9��+�R��tL����;� ��M�#> w��QwqԳ� �#Ǿ�2�*V���魘�ɷdυ_�e�ɋ=�-L4�H^Y� ����9��f(����G�~�` ����� ���`('�\�W�������Z���*��0�Ϋ�!_����:>l)��f��\�f�Z�J�KT�(RK:ؕ50��O�;v8i��\�`��ήe��/�Z��Z-I�����"�F��P=ի*�˓Hl�� 4�h��*�9>���qFMu�4�>�iC�l#)q��b����"7����پw}�����2B�rZ��2Q�����QL�����)��H�[��݉�:&��zw<[O�+����ʵ���t>H��leؓ�so��1C���`:5R�G1� ���[�?��6 ,Ƿ3���&�
Static task
static1
Behavioral task
behavioral1
Sample
Parsnip.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Parsnip.exe
Resource
win10v2004-20231222-en
General
-
Target
Parsnip.exe
-
Size
5.6MB
-
MD5
01d1bc9347ab361dc7ab802d0c22e655
-
SHA1
2f866ebeb93d64f4962ae292c0a83f5fdc9b0546
-
SHA256
69e2670833c4514bcf3f83004e3b040b953e503347286739234b4e70e9eb76fb
-
SHA512
b306b8c5a16f7b308405ec4ae31a896cfb2ed4725fe061aec2f9f1984ae58383a1c3d69bdfc6817753e5c1196110a16f7e2dbeda44f6479f784961eabc3dcdc1
-
SSDEEP
98304:l/het+VsxwxLZAqAR5CsvEulv4VoZfTifm3brjC8A4a5tXOxnDtyLXEbVO:XDmKxLC5Csv9ifm3Xa5t+lMYb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Parsnip.exe
Files
-
Parsnip.exe.exe windows:6 windows x64 arch:x64
c4373d2c2dd3b234fabfb130a8e315e7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
dwmapi
DwmExtendFrameIntoClientArea
kernel32
MapViewOfFile
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetSystemMetrics
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetStockObject
imm32
ImmReleaseContext
msvcp140
?_Random_device@std@@YAIXZ
d3d9
Direct3DCreate9Ex
normaliz
IdnToAscii
wldap32
ord211
crypt32
CertAddCertificateContextToStore
ws2_32
closesocket
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140
strrchr
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-stdio-l1-1-0
_pclose
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
fmodf
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
_stat64
advapi32
CryptImportKey
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 770KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 138KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.TAZZVM0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.TAZZVM1 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ