u_o^_ަۭԁl�o�yz���9u�X� bW �iY�4�7ǫf�&�%=���O-�@ �!� ���D���ͭ���� V�hX�\�g��g \0�Ebѕ��Ćԟ�/W� �"Lo2ijCx� <S��A��?ej�����R�EDk�}�ݻʹ�f$A+*��uH�~�F�-�"4����&8���,��g��ux�i�b�����^/�V��lTa�.�wg�3}����"w�� 79}3#�`���vE>��p���:��*�/UG��fjOa���-��F!r�p��=���ߨy�M���1�*K��uu�~�Z�/�ztx�H�;9s�z�7���e�=����BIx� y�t�Ԡ�|t�ڃ.$�z��Kz�u���-�Z5w"SG��"D�环�Qq�����Kg�5s �����w;oO��frT��gA��%{�c�_���ɜF�"@G��#a���c[@��)�p+GP������5-�WQ��;)��xqgp<�43͗y���>��Ck�E�|�A���Ov�.����W�@b�2��n�:cŹ��$}�͊&�>(�_����ƴ7Ԝ��|��Vh�NmWaַG�����e)�����@����8�$��=�� ���O���`���{�5o a�_��dfF�n����!�n�d�|D�RfmG�P�nf��l�X�t�!�#��?k<\Q�l%�;�D��<��2��1}��/v��8E!g�^�rk@�o����%�<x3�C㷕��%�x�2�64��� ���|�^?����00Z�{���:�M�X���]����kJ�T1XU���{�F����3m��K�ڏ�����v*4������O:he2�{T*3bf�LC$��#�=i�kZ������3��4ހ��P"��anD�=/-���hqX�,ފ:̾���/��'������D�q�H��!ǜy_\2K��z�p1+��V.��L�8��c�$x��������C��b*=7�:'�YА���6�E7�ș6C9�p�{f9b,�ё �]��� ���0?�nI`�����cz��=G�A<�"�j5-�}u�פI�����ze�s3��I��Yj�%��9�Y|!���^z��� V��L�� w �����p/��ם7��_p����ٱ�{�6�,��kb��[���������[����q.�O30���1���Hy�M�t rJ�=]s<�ST�`��-g�v`ū}S���v@u5Þ��uOU���C�q�=:>Vxh�U3��ߑAL���m���Ia���k�P�i؏�[l��V~HG���2!�ҬH�I�����8�\Ɓ�M�y�R��}���C� :s��ΰK�7N\vj����YN�N�tGp����0l�����YL^8���5��c��})Q af�;�̈���AQ��I����FފG��j����Ĵ�+h����~��?ㅨ/nLr퉿64@�FD������&�V��:^i�z>=�HI��7����v�3!�*�y�x\�9����4�`�u����,�!��7� �������;��xrG���W��T��v�t�g�Me��l�*����>� �7�����.|��d��s[��5�͆-�����=�:�{y�0t�k�����f ���Џ�5^ēh#��n��VQi[4�� ��/��3*�I(ƙF��2�-ot�`N�`f�3����}[h�ɬ8_�\NЯJD�X?�6��2\�z�^/�[>�Y*��+| ��Cl���~�䶩^�o8!� ��j����3����%�# ���؇�KU��wq�Th�ݧ���_�nV��eh ;H�/�e��Q�����j���Z�$;��"�8@�I&����?7<�|��&x٣˓�a�{�}z� �H�EN)ܶ�p��xD�%֟V�±bC���w$9�6�&���}=gs���w�6��L5^R���� �/[�z�W$_�u���C�����8�-s��#W��Ɩ̎U� ���IRW��e/ܖ�腅�r�\U�L�t>[�=?���%��zj�>~c[Ik5���>��츠�܀�?8��j�:��p���������&�$Z��[�a��W�)�t��@z� ���P���˃�Y�b����.�݇�aNCR3�oe�.B��iY�(����$ʾ�,��#XО�R?�a���e�uX���hCɢw��>1&y��>�Ƞ.��]���~a���.9F�6����0b��qMn��S�]v��w��K�M��sE,}l�M���ω�1�Yғ9k&* 6��X�~ၵ\o������'��ƓD�⏀l��7��h��0��_��T�6���[��_���Jl�}��F|l_a�q�Y�?�����?|��(��7}���T[�{��2��F�ˤ�Q�?+ Þ�g��]���g2$�J��������v��9�9oĝI��9�`�@-��ԇC��#%�wh���D����N[�H7)n��g'<�^6QH6�s��*�很� ʫϞ��=������Ms��)�&lVug]�|L� �rc���_̜����K��\�>��Nt&���:��B̗n�W:�L�n���b�-Ms�#W�8j.�"Đ���}�Y�A���WR]^*���$�@��y����ajM�ml7<����g�`�H{ ����!}~W�%y�ҌX�'�PB��i���p#aX����$�`73��Kz$�$\"jiI*�)E� T����8ʥ��������#���s��E���y�N�kL7� �G�i)�<V�?%ts� ynn9`"�E7�ŭ=,��E���n-��4�(��f��0~c�}��:��������A�j0�=��J��fݡ�f�]��݆l�`�ę_�X*=�'�u��s��6���Ms>o���o�O_��@/|�˜���ޝ#�x�����#��L��4nV�t�V%�2Ăս��*��C���Y�Լ��&�r�K�����;�����H on�� M93�W~�`E&��6� F��:h�[���7z�f�=4'h?��*#a�O����X�:9�:���)�@MU��דY�k����ZY��Dy3�,�v~��Tz��$�W8
Static task
static1
Behavioral task
behavioral1
Sample
przv3.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
przv3.exe
Resource
win10v2004-20240508-en
General
-
Target
przv3.exe
-
Size
17.8MB
-
MD5
d6f73cc1d510e743a10d7810c20af810
-
SHA1
62fb77628f2d066d98c7656e0b84499ce9b9da94
-
SHA256
7e791afb9e4818496373828afa76df01fe6a77075b9a94095c54aca5fb24b2ac
-
SHA512
c10122b3a6e152ba2cf20c6b1220289957b5c8442b183e34da61381c6976670652a35eb54c08536469380ddedf932f54c38fca519425f7c9c92b9bf7528e90bd
-
SSDEEP
393216:oZA1UlLze3AvfDwCCpjNmXhqMnOQCRkDr3X+u06rSP+:8AulHe3A3DwCCQlOQ4kDjO96rSP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource przv3.exe
Files
-
przv3.exe.exe windows:6 windows x86 arch:x86
f0412cf3bf41403f93328aff376e1977
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
MoveFileExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ReleaseCapture
CharUpperBuffW
gdi32
GetDeviceCaps
advapi32
CryptGetHashParam
shell32
ShellExecuteA
d3d9
Direct3DCreate9
msvcp140
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
imm32
ImmSetCompositionWindow
normaliz
IdnToAscii
wldap32
ord46
crypt32
CertFreeCertificateChain
ws2_32
gethostname
shlwapi
PathFindFileNameW
rpcrt4
UuidToStringA
userenv
UnloadUserProfile
wininet
InternetCloseHandle
ntdll
RtlAdjustPrivilege
urlmon
URLDownloadToFileA
bcrypt
BCryptGenRandom
vcruntime140
strstr
api-ms-win-crt-runtime-l1-1-0
terminate
api-ms-win-crt-string-l1-1-0
strpbrk
api-ms-win-crt-stdio-l1-1-0
ungetc
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-math-l1-1-0
_libm_sse2_acos_precise
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-environment-l1-1-0
getenv
Exports
Exports
Sections
.text Size: - Virtual size: 826KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 122KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.'u~ Size: - Virtual size: 14.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.^4V Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.^M, Size: 17.8MB - Virtual size: 17.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ