J~-�۞>�2�^�2�Z�ln�jkVZ3�@�wV7K�~|�M�eg�ք��d�p�8��y i ��=��N�ֹw�K���s��>iPn ڋ�N)�:�����P�U�O�y,����0���i�ܩB����em�����*���uc�y|�xmd��܈�5�7��p�^�1+���(�o������m=Q��Hj�[L4F�����ɍ��(�����#yNuC�?_乳�@�-�� �J��Nh&� �Ĭ�������#��>S�I�1����2Jd�^L��@8��׀z��ħ���������} nf�����s*�����L] ����N�e �Q��b��@����A�^L�-�J-�ei�����>APn�Ys�" �o;t^R�M!��|�d�U����.#��8B���Y��p|�(�㭏��q�PN/3D,��(O�RBC�.�k���ɼE����z�?�mxB3��1� H�H�o��6��(ۢ(��0�vfi1�̊�)��ް`�*���(Wѵ-�[�"d�P�K�MYP�p�s�S�&>*<�U�"�-�AY鎼2)�n���w��M� �NQ��Z�g�pF�b�UaZ`��o�ޫ��������T�i2���%��9�.�`�զ�iz6�S��+�@�Z��$Q�ӤR�����5����y��9Q��c�V^�� ��o��+����Ɗ�������RY�݁�M���/t�I���]U�a���2�B�����%v$x�#-X���A���wʏ(�M�HXypIߤ����ʳB�!�Q�r|P��C���3y�gzN���(��dv��sj/(�т᩺@�q���ߖ�:;#p��HIj ������a��Ue]hR._�35���O��*j�B��=ܨc�7�:��W`͞[�&ּ����X�@�������@�Ry���;h�]���4���S �����r�İ� j���i�7�����I7��5�ق���$���9�![<����U��`���� ����Mx_3��°���ʡ=�n����c��� �' u$�9�ER���X�"��hL笻` ������C����bDI����F*�/�� 4zJ�Ir���\Rry�r���� Y?"���lӫ��9�O`ŸHѓ��z��c�I����A���F���Ef�S�q��%�%�bg��7����I��[4*{b���P�����Td�����c�#����f�X��h\��Gl Mk�pE���z��Ї��2���s39��y��_b�w��R�u�):��UI��h�T�%��i�A_?@���S�։�����c2���c��dfʜIw9�\��<����a͡@�?����_$ļXUM��+��d�l���)��u�x=-�� ?����g����7� ���6��#����"����/���X��B�h��{� TD̐U��f][��*�T|���}mw���Q�?�H����*�"���$J�b>��Ւ�L SHGp�}��9�-�dhb��F�1�i(V_K6�B��(��p^-NR�K�'^T��e�BD���ڞ�ռ*]:��,|��M:>�M���e�{�H�tUw���4b��m}m"H���������]{,ی� 7vAQ��~N��L��Fe����4O�my���&���z�9(�����7�CÈ�ԏ�G��^Y,�M�[�gv�/���j��}��>�՞�ib���ONB��������09˷M��<�8�]&��ݒ[�#���H_��5v�G�^ +��ZbR��>��B�݇���^'�I��>�����G�� �Yr^M�5�T�ף����_z�,U�b�v� �*_.�P-�i��FWoE$?�ݧj������!3Ծ7��ـP.n>��6��Q<(�-F�����5�ot�pz�����3 �Y����8����ɉ��/Vm����s�\�3�w� Rv{%���n��n�q�1��2i�̴�%��|��1^P��zCwj�����Bk0(�8�iO��w���I�>�Hv�4�V�i J��Ne!\Y��s��|n���-�mG%��E:p��Z]x�����X�*� ��Ŗ�ʦ��s`!+^�JK�dU뚖��a+{���ۅ������UV��6�Ә�rA��5��M���i���_�e�,�CP�r��Y����̂�f%�=����v�ZE�$ܰ���f��"�Rۿ&�3|'���A�����������~d��P/�Ť�� _z��蹥�h���cV����� Ʃ\�eu�i%���T\�'&��\e[��?o�9���0 ?n�"X+��(/�PB���*r����@��)�3�9�%�$9��*����^�BS���#�1</;���F�pI��J�Ky�ICd����ݒ� �#CUd�g�� :Vv��si#��\�1��6/�9��� g��ȭf�b(�a+������&�Iݔr���9�"��O�@�V�ۂ/�e89Q����~��ײ(}��?������xX�h� �D�G�W���rF`B�ʢ_�̄�zQ ��>� R�f�,�K8���KT;</���0�" ��q�'7ݵ>�'�X�[\���L9o0f!� ����Q&���8��1�������9���O �Ӗ����t7h�ԡa��wi�?����UT> =���7,)�>6b��C_`����'�=W"�P��)Bb��� ��N�Z��;<�?�3K9D��V1�D��%h�P+��5<��z�mB9��P�����[�&h|���,��|���qd��Nu&�� o��D F���֯!t+�搔�\�E���IB�)/���K#��[���_:�6$��*�D /Q������h%O�`NyK�J����%���w�����P�ʥ���}y'$U�>��0S�����C<��cA��!Z��E����ɺ�����f����i;�[����;V;��G��5��RQy%�Ǖ1e�1�w���艠�,cHl+Ŕ��$\N "JȨ�Y�0hq�*��Tf�n ���k$E���S�lG�^�y���xMՖ�+9���(�������h�� `��.��� WcO 7'�,<ݙ�G�g��ƾ{L�K!�"����i3&s�*�Ձ3,|K
Static task
static1
Behavioral task
behavioral1
Sample
plaza.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
plaza.exe
Resource
win10v2004-20240226-en
General
-
Target
plaza.exe
-
Size
2.9MB
-
MD5
740cff15cdad14d33953c5f9887ed35d
-
SHA1
65ac14e18f8e41291133606aeed67b9e72758e24
-
SHA256
1451d7bf813f1cb10782f079a4ada4dd905f6c29101b9a602f1f8f5ffc641087
-
SHA512
93b531d977f41b0fd7c0c9ac205b660f929d1a23e72a291d8ad0118de9e880d691d12255a4d9ce2b6ea427033caf3edddb1394966a29d79f07ae17cb8407487b
-
SSDEEP
49152:0PDyj5aui74jGD5NiD/S8ZLU59fNgChKwVL1peSWH4L9E5WXPa12YO07Xo:02j5acu5Oq81UrfNgeKiJsSWYLC5WXPP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource plaza.exe
Files
-
plaza.exe.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 461KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE