�~�҈��G��;u�*�R��1'��SMf0�v�� �-S��e:a�4�FKC���y��hN�+��ST_�1���/=�h�S53P�%K��Y����c�!����_�����ٻ����#���F��Og���m��{�[A�x͡�TZ��m���0�68k�tH��E�R��_�U�s't��v�\��Q8\�/EBд�xi����٘�q���Hz"����S�s�<�$]��C8�� 5����|����>IJ�B�n�:��E;|��7./�������r{<���xc��ޭn�.�c<70[� ȱ�� =���=[x�ǽ*��l�~����Sw��k횂W���{ ���2���a��W���Tn���%}=��D�F0�õp�{�6~'#���[i�E�m�&�ؕ�z��������w�Y�\����H�\��7�s����+O��&Іe�������5u���}�"{ׅlhC�7u*�� �sۼT�)�X��Y�Z��c���s�u��.���KK=r��j��VJ�iۥ��Vߵּ���5BI�f��A����(�|�[w���(P"��@���96B�@�t<�e{��� �(��v�<� m`Ǟ����ObdJ�F|�yܙ���%7��篂~�Z���y�E�|�P�qt����8CK̮����zE��PX�� w�B�5w�+v<�}!��F��nu��L�M��O�S�9��.`���`Xɜ)����tE������(J�1}@k 3Ԉ nc�<v.6��s�z�7,���♷t �/ �Z�����| �ޕ��`��/��ugL���݅�x�}u�����'Aj�����{�p�g� �c�W�'O��V{M����:!�h���UQ+�R���Н3㚽��;��v�Ț}e^�U��WgŠ�h�R���]�EN̍km$�:�Ddx�E��qe�� �?�pK������Y�)U�а��cV�Ay� !���T�@LXuP {Ѹ�]v/6����<���R8�L�p��L��||v����c%����j�ς�=�R�7�z[�+�ao���B ��N��3iW���8�Q�~ G���6���;�l��y"�Қ""?Y�o��#� ә��3?�k��-��Qݪ�.���h|��������T08y/v^��a`u(�ພ�Jw{��>\��S_KcMѾґͨ$�)��b%���8�>^3�T�4�p�y���y �Y꿾����+z�Z_�� J��Ǖ���N��ȺQ�3�6g�������%/���kՈ�B��d��߆K�_�6�TZ='���*ZO-��Amn��������3�W"��mt�!���b�����S��M�� �j_��*�����6O��=��K52��v �h��0Mfz�r�-`X�� �� %ށ{F�e��l�G�"ϐ�����x�'����,��ʚ���Ffm_��Z�,���-�q�)�1��-F����R��%G|%�x�������f��b-T��;�,OT��WA�.����� LJ�BL,!M�?W��w�Y��jT��ܮ���X����-��?�%q2!�j�泭�WSD<N���}�)��l��u�f������xl:?VTM���k���X~�N���1%�^�@Op�A���w�5�M��N�U��5�Tlrͭ���}�%��o|�=N=h�j�\�� H�˞�%�������.tY�l�߉���7�d-� l)�]<圡�̼�;^��i�9\�-w���02�T9�.%<�W�H��ns� o6&���d�e���*�7��6����'�F����ٿRΆ�����R�#�s�� :�~�;���7C�Tw�t/ԅ�|��g�ڻL�/���8]��1�uXv��%����HZ�Z"��Ȗ�.����=Yj:]P��zy`Q����q� ˏpk�_L�K�{jB܀π��B{9Ͷ�"?�P�k�D�0o�cs���b�sPr�{�,{1TE�J�2%] zm�#���J{3�@CJ��[S\�qɦ`�9ĵ�����@o��ߛ�*"k�cJ4�i�,�]E2B�k�d o�����=;��ceM i�Ѿ��=h�L,̅U�����o�)����M��������Q|�=�+C�~�X.}�Ka�d�����V9�v 9�B��P?�o���q;�E"y���O^ؘ�L\����X�yqd�a:b_Z���rZR�!�01��څ�)Ԏ��������*27����"un�y�)X�-S������MJK�y%];�2��ԅ_�������%�x&�M�>"v��B�ѫD]M��e��z�X��"���v�������mN��Y����+0� �*1��0��q�&a��Y�Ƭ��h%Kj�ן�!�=\�b���N�}0��m�����j�4\ 5?��?�8�.�(&1Ӡ5�~iq����@����#=���R�f-�MΥ9��p1_#ư�T#���S�&��~mXҠmpLH}��ݬ3"�#k3�a+���+xnj���ςm�WZ�Q&������t�K�l��@WͧP�Ϛ����m2x������?�?D���̤��}��A�J]���K8�$uh$�3�MO|�`�:�\R�0ή�X���J��W>pVTe��8oa8��k�3,ye��d����h4�/���e��!����]����t��jy�v�Ib)����x����c�m��c��C������T��?�"J�17��pE��22�NZ#}�;Rt�8� +J�z�o+,�v�Nq�Uɓ��՞$N�hH��r}�P�q�'[�f=&P)놖ɛ��d�k��28�鄲ur҉� �sT� 3����Zר������Ԋ��n��"���/,��;_�P��I�c���w�áa�+02��(���ʐ��+A��ƞ�,���頂��<AB*�d�"(;���ș����[T`-��]v6BQ� �&)���u�$4�v���xI�%K�B��2%����J�o:�"�{4����-�h�E�w-|��:��4�A��l?;�y�Q���@�.�`�Ğxr���1+�����'�m=
Static task
static1
Behavioral task
behavioral1
Sample
Mw2 WallHack/mw2wallhack.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Mw2 WallHack/mw2wallhack.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
Mw2 WallHack/mw2wallhack.exe
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
Mw2 WallHack/mw2wallhack.exe
Resource
win10v2004-20231215-en
General
-
Target
0122a39a628f3be5d7b0c31d8fec65e4
-
Size
179KB
-
MD5
0122a39a628f3be5d7b0c31d8fec65e4
-
SHA1
8b8a654c69e34ac0c6b80768042c24adf205e0b4
-
SHA256
4346b00eae98ce17137586b0c5ab6366dbef4c3a71810536122bb8607925d1a3
-
SHA512
338eaab280e81c7085c5d01c39864dcdf94d0de4df0dcbc6bce954617f1306f1762ec93350125d5e97f5b828f8b7486618d404c7bb1a32649a8d069847539134
-
SSDEEP
3072:STGUjv78m99T48eqwsKdnD6uvBMob6gB/X6BkagKEO29xxfzx26velLw4M5nXu33:SK+5914VsKd9uLQcVEZ9xv2Ce4aU5pRW
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Mw2 WallHack/mw2wallhack.dll unpack001/Mw2 WallHack/mw2wallhack.exe
Files
-
0122a39a628f3be5d7b0c31d8fec65e4.rar
-
Mw2 WallHack/mw2wallhack.dll.dll windows:5 windows x86 arch:x86
58ac337b709791c3533c3f67dced63df
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
InterlockedCompareExchange
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetMessageW
winmm
PlaySoundA
msvcr90
sprintf
Exports
Exports
Sections
.text Size: - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.g3k5h21 Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.g3k5h20 Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.g3k5h22 Size: - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.g3k5h23 Size: 140KB - Virtual size: 140KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 304B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 686B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Mw2 WallHack/mw2wallhack.exe.exe windows:4 windows x86 arch:x86
5eb88c7623aaf15e1d0914cf023eab57
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
VirtualProtect
ExitProcess
Sections
.MPRESS1 Size: - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: - Virtual size: 454B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.r8z90 Size: - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
.r8z91 Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 52B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Mw2 WallHack/mw2wallhack.ini