����?}���7��1��L��ST��@ E�<�Y���xn�,bѱ���A��B��m�D��.1c�xLJ ���8#¸>$Y��r����z��R�-�?�p�+E_�+jw�-��ښ��W�K"�eA�9P�)!�Ќq�h-�-�2��ǎw��@���ޅ��lՋ?��]1�Ψ�!&�ڷ����A�&j�ڈ�'ֻ���!`V��4��������,υ�.�]N�D�8^Η��I%�7�1-;n���;ۀ�9��=���3�/;�֦��u��+1�Z�����=�_�����=!���lO &���{[�6@�"(�sH�4[�����$��vaRN�k<��pP���f�4l�|���;������a��I�f �6@q:~Q����/��$!�5k����X��TT�rxE�L�F����5|�2�j��RQ�EĦ�=a�ZНu�Pe��-9{)Og��)�)�Ag>qI�Boݽ��{o$�X�����1(�� �R#4Rb��b�jTPD��$�)θ��0��7Vg ;k�I�F!��\�0���[_:G�X��:.7���+3�q��B$����!>�Ho�}��6Q+�v���t���w����X���S�rTc�<���f�t^ݯ��x���Eޔ?,r�(��V�4N�0'n�.� ]�u�g�-u�}���Ѡ�5� ��L8M�TG��C��|2��{S��B�so�<5(�E��z�����i46GW��o������/��`W��(��پ��� $��D�KI��r �fd�_��%�����=�,�M�F�*��7~�#'MOyi������d�ĘsRO�:�����)�U��I$_^��$��MH���Ι����RkZ6����=&���5_���3�r?�xi3ԩ�EI���x���u���ZiL���1^}��:��^nx4���Rf�띌W���^�I#g+�nʪ�,�Qg���TQc-9R�����f�\h©s5�{����g��J ��~�Fu�9X]����9�b�B����<#����/���M灛q����2\���:��Q%�#JX��ŵ~J�g������y���ۢ���8��k��L�eR���ػ�<��6����L�ھ.�,��2���U��([o������|{*&9�CB�����k�v�����Y}y�vv���<�������0�������`i�eB^MZUn[��-�����sy��3�?�w (��L*�������J�|CI��B_�����\*�/�T��]��Y#��'�8=4���Շ�n��y[�E����Th��;|=�fv�eE�|��7��ם��㯋>��Y�H��)����H��3ݪȝ�����,MMݔ;!wO��8��y�g�@}A���nx�轰DB�;Ј�K��Ӊ6lo,B���hJ�d"�Hа�E����[�/�����\�J��O{���[(��ɺ,3QV������N`��QVjP���T?a�ɟϚ� G�5܃�Q�.�JzW�@� ��H���C?lk�W�[9����5���o㎍dU�V5���?�j� ]��}�Xa�~��W��2{P��_�~���e���������W�p+��O{Wp�L~�HN�X*.�[K]m^�f5ʿؙ������$H�����Yy�>�!B�������쳱!�y��fuü]u�U0g��/�%��u��4ZS�oO1�,T�r��ٸՓ��ds�����ҎƖ:��q�AL}�<�p�S|��5�f�Ov �7��GN���p�#����!�2���V�M=K�c/��`"�fϞ� ¨W+Ǹ#@B���*� ����������MT��z��� Cg�Y����5�Q�K�d IQ�qR�F/���d���[TW��� ��s��x~��*����h���Hz$i����3�{�8 �MQ�~ƪ;�~� =�%f��R��-�]B���1������߶Jl��sr�k9uRDN�=ϫ�ud��G�uJ�hT�a�A��P�*��c�wMi�y��R��(l"��Zs̈́4{m ��8P��o a�|��2s��d�L�4�;��k����z�����L� *��v;?J��e�蜘��Bb[=Yo/�XL��F�����M�,�y���������Y!�;��+�*��w�b�_���kB����c�['cy�P��Bf��ٚ�����3Ya@�������UX&1|:��!�qőG˴'����(��\�L�x2;��Ԥ4�JN�P���ӷ �il�[Ѓ�p��z�ȴ_/E�M�zW��w�B)��g��)�,< ��,)��}�^G��<�dxp����vJm �6�k9�Ŀ�P|bט��g�AےIK��n�yZ��+�=��9c�W? ���� ���W�(��9wi��g��~���-^Mp ��L��J3:�Uh��Qp<�_�s9a�Lv�p��_����d����Ȑ�졲�P|��Hs��ME��x�����[A���ذ0kB�����%�!1����0�%�I @�����l�����iAPk"����!���]`E���N����z���VK@z�3N&�|�?�M���F8:ޙ-����=v�)���y&���:�q��Օ��e�/�\�4ɖ_@\>�x����� �x�6yի�>F9������I�1����'�&8�o_@����y���f@}�o���s�$?���ho��lʀ*S�./�^( H �����M� ����.�K����dv���8�j��{i����������$���o�P�؝y%Uvu:&m�f\��ڻ��y����. �,k�?G_tg�WZD[���u~]��E7v�����$b�#,˯0�"�c0=Bb�j�-�p����PY}s����6d��s0��6?sT�Sl�?������5�k����$�^Jʣ�<�km��> 0X-W��Eֆ���� �Y+"�Q�6c�#��fi�{x�V�Ӿ�����:�L���Zc*X$ނƻkf�C�O��"���s{7���N�6ܾ����*xB�E�m��ۄ�~��W���}�����;d짝9�8�H��9�c�P>.0孛Auխ��B/��WJ�0}
Static task
static1
Behavioral task
behavioral1
Sample
przv3_fixed.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
przv3_fixed.exe
Resource
win10v2004-20240508-en
General
-
Target
przv3_fixed.exe
-
Size
17.6MB
-
MD5
351980608139c74da483839214167834
-
SHA1
ebd530224050f7ca67e0aab4c35b3cc1f16532f4
-
SHA256
af791d4f80ed078bac9da9b7b26099ce96756eae4ccc7b4efeb99b04e75ed33a
-
SHA512
63d45687e323fe6ea749532031ae0e924fa46140e4f1a724e151ba4fe46598f7325b9cdadc1211cc5a1958684f94c87377375b862f0140de8c317e39b5a9be63
-
SSDEEP
393216:p/fQ+DhsJc36GBXmcUc/+VF1z1zns3cA9gi5VLfAPz/Vqyo:p/fNhsKpplZ+VJiOi58q
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource przv3_fixed.exe
Files
-
przv3_fixed.exe.exe windows:6 windows x86 arch:x86
ef2964a2e7137c8b0c8be929fbe8c02d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetFileType
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ReleaseCapture
CharUpperBuffW
gdi32
DeleteDC
advapi32
GetLengthSid
shell32
ShellExecuteA
d3d9
Direct3DCreate9
msvcp140
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
imm32
ImmSetCompositionWindow
normaliz
IdnToAscii
wldap32
ord211
crypt32
CertOpenStore
ws2_32
gethostname
shlwapi
PathFindFileNameW
rpcrt4
UuidToStringA
userenv
UnloadUserProfile
wininet
InternetOpenA
gdiplus
GdipDisposeImage
ntdll
RtlAdjustPrivilege
urlmon
URLDownloadToFileA
bcrypt
BCryptGenRandom
vcruntime140
_except_handler4_common
api-ms-win-crt-runtime-l1-1-0
__p___argc
api-ms-win-crt-string-l1-1-0
strpbrk
api-ms-win-crt-stdio-l1-1-0
_fseeki64
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-math-l1-1-0
_CIfmod
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-environment-l1-1-0
getenv
Exports
Exports
Sections
.text Size: - Virtual size: 825KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.<-\ Size: - Virtual size: 14.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.hGb Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.G~g Size: 17.6MB - Virtual size: 17.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ