W8�<�h��^gb�o�A�vaM��ȶ@��v�Y��>M����<NC��|$y�$�8��N�Lj1he�������4����z,,*7)BȰe��p�^�p�D�#z��W��>�!�`�5[�٨� WɂX�X��I2H^{�}Kي�֕C\YP�������by��~��I�y��c=\�`������**��x<�G5}z�!g��Q vH�c5*+q�2��(0��$)����*�������ʋ�J�X�z�AkS"�B᪴���$��xgnjp�.��XO����4y�C�07��V�[h`�Cg�[n/�2*c��L�G��o���>��Rs�]]iKU�*�I�����#K�~7����/)-"m:���婂$�g�A�O�� ��z] ������iţx�nS�g5Xi����j�������z=�5ރ�3'�0�rY��"�����Ud��|e>� (SB��֑G��Q������տV�8/I�y�D6}b�� ����U�D{5Yu��ޓ&Y::������������0v#��P��������]B{�QxW=�����hۮ_Y� ��6��ʰM��ݭA.����׆�']�-SW_��l�u\�x��\d�t��"���Y�OR|�փ����P),!}W���?z���\1�}G��!?�ʹg���k����G�_��Y���A�b�K�?�34't9�7�b�d���G�'1.�1�z��:=��2����phCɚ>�N�u�B�KC�4 ��n4fԋ��&:E���$���<��=���nao�S'�s� D���u��~}��<�3��e�Є!aן�����뒻���ؽ�T��2]�+m\h��T�>���M\V�/��%n�Z0#ko:��۵�Ҭ�C�yM�)Pk2��,�*6@.�����x KK���e��h���e��\�b� ~��$Ă%�!%���"��i��Ar\�|Q�X�kju{���&���d8-5{�#��DG�# Tu�n�k���~A��y��/O�:Qx�.}�zC�MH!8"�ƥ��p麴Iiy���+&ʈS�!D�� ��!~8�n]hfQ[�F>���{ΦeN�<�����͖EL*�^���q�M�Q>2.Y/�(h!m�TF���8R��P�(���a�W-h�^��w�hwQ��e�ޭ��z�����cxR��~�����qհ��֕7�Gs�\�� ���k\Y}�b`{V��1Ĥ�h��ɛ����� �~�]��9BL��2�+^��� �B � h���u��` ����=<Q�����Z��5���6"�y�q&��b�a-�Q-X��1�pU���7��d�T�}����v�p�{���aB-�l7���Gu�� � _@���� �^�ϑ �����N0�g�]�-%�l��Aaj�O���^6�Wjw��Z��ߑo6�����/�e{:��G ���i�i."Ym"i��n�5F�oG��W��*Hj���QG6Gö{�L��D����EРՅ�릢Lc�A�Q wb_�*����(�GM|��'=1��< W�����(Rb�A\'��D�mk_@�P�XF���ڏZ�W���]��I�XXi�ш�Ď�s���L�������[�B{)'v,��RIa��:T�_VKD��zPn���(/�O�F�klFQ�p��$8�K:�d��ӷ�+�E�QsC����Yr/�k�D7�������q�����i$`��xW-�.u��Vb��jH���_�0����7U�� �g\����'���r(<ٸk�%����$H?�|�/4�~���n��B��7Y���JZ����lɴ��"�F\D�AǕ���M�'�ʏ'�Bģ��o(��������"+E��AG}���yDU?��4Q���-~����O����8=t�t���p|��gc9�)�mێT�S�f��N k=3 ���$��VW��G [D?y��ұHy��|�m��S\A-w!�7"VU`�_T{e���$0Mw��&����K��rS�jJ�@(f ��N�c��,��p�F�r0]�5÷�cm'I+�t�?� �X7�'8U��[i���F�����|����nF��W_6eo/���d�2��Z��1��D�}��� �lp�(mb����Bh0�=��M�+�I���+>�/�������M�`�I|+�2�%�Ga��[�����Y�<1i}��]������'�47�����b^_�{_���V*_�)x=]=~7�����DY�)9u(���L�pw����xφ, �H"|w��qƼ��V�H�?+:d���*�w�Tw�`pB�)I�4%���r�s|JS����n�K�Vdw��L�����r?�7�Ӹ���k�B2̄;��Al|��L�тt��<�+����M�"��������7t�f�q�VMI���"�\Y��UM��;e�C����s+�Jb+���D�Ԃ�/# ��?ݢ0r��,�`�B�6���;"#*=�Q��md���F����tS��n��E0-W�Vp�I�[�o�ġ�Z�g����m(}x7R�(ӊ irQ�82J���N1�E۰������r=mb�o�z� ��, n���Ey]���@} ؓ0��(@�OK�U<>��C��v�5^e���0���=�d�s�I�c���#Яُ���.� H!�&�d�)4f��}�S����:˕���?�]��31k��0�z���K�x!���/��Xn��T1����&�ea/q1�J���\#��9�ܕ�2��op�_^���,���F~�2�J��K��g����ڤP����G���P�oMN��3�Yo_�R��~Yp�iZ��±��UB�L��qX�@ὣ1���M{N����-]�[��d>0�d�!B�|��~����h��iG������(B���-��� Ò�I�+�����9w�=��]�h�����������{H��(��Y���d��y8��@=�9%���ɀ�>:�]�zꍠ��ԩF�����⳥�v9Ge�Жp-�G�����*]�K���U���i�d<��<BQJ��m9KI=Ǡe8oKD=K����G��1�;_:"X+_�c����[��$�"��!)-�
Static task
static1
Behavioral task
behavioral1
Sample
przv3.exe
Resource
win11-20240508-en
General
-
Target
przv3.exe
-
Size
20.0MB
-
MD5
efe7f65b1969cb1749f1bdd791b73fc1
-
SHA1
e57bbbe23c0df2c1cce7a9a5a7c0bda3fc18ec60
-
SHA256
839c229371cc48edb48b36369db13e96f1d408600b01dda993db9f0c01484c22
-
SHA512
a37babb690b32c41122df185c7b6256f290625af1eafae4d060643cbe06e531070f9546b79ee2e4a86722d6c6ae2b4a863fbac6c92c59761654b7d1a4e11528c
-
SSDEEP
393216:W4n2pb5ZmBHrfPZHguQr8IB3LpLsvghnEdkF9xQydzbt7s:5arWHDJRQYS3FxEknQyfo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource przv3.exe
Files
-
przv3.exe.exe windows:6 windows x86 arch:x86
b2f9bb3017c3c45cbc87e72c69244023
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetStdHandle
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ReleaseCapture
CharUpperBuffW
gdi32
DeleteDC
advapi32
GetLengthSid
shell32
ShellExecuteA
d3d9
Direct3DCreate9
msvcp140
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
imm32
ImmSetCompositionWindow
normaliz
IdnToAscii
wldap32
ord301
crypt32
CertOpenStore
ws2_32
gethostname
shlwapi
PathFindFileNameW
rpcrt4
UuidToStringA
userenv
UnloadUserProfile
wininet
InternetOpenA
gdiplus
GdipSaveImageToFile
urlmon
URLDownloadToFileA
bcrypt
BCryptGenRandom
vcruntime140
_except_handler4_common
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
api-ms-win-crt-string-l1-1-0
strpbrk
api-ms-win-crt-stdio-l1-1-0
fsetpos
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-math-l1-1-0
_libm_sse2_acos_precise
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-environment-l1-1-0
getenv
Exports
Exports
Sections
.text Size: - Virtual size: 817KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 125KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ia_ Size: - Virtual size: 16.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.MUP Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.OXR Size: 20.0MB - Virtual size: 20.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ