iw3mp[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

iw3mp.exe
Size

3.2MB
MD5

26c78b9c82e76ef594e75265bb0ae306
SHA1

c160ae5e89222d6930925e3389064d1a1136e157
SHA256

f50f8a520581754e73cb7cae67b02adcbad5f2e71aaa412a013bb3ef57a391a5
SHA512

246f42dbc146804981079e67eed6d3fd0f2288c7add6d6c4ff022e42ed4dddcd127b7383cade58d37245f865a5af17c329f3c76230182286a7843469ca1b712d
SSDEEP

98304:Zr9Jwi+bwCCCXj7mikZM9YpkGTjxFb+sOo0M4XoX0Ap:Zr9Jwi6CCXj7mpZM9YpkGPx4M0MeoX00

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
iw3mp.exe

Files

iw3mp.exe
.exe windows:4 windows x86 arch:x86

5d68b14890e52aa2fa37841db44d8d1f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\trees\cod3\cod3\pc\iw3mp.pdb

Imports

winmm

timeBeginPeriod
mixerGetLineInfoA
mixerGetLineControlsA
waveInGetNumDevs
mixerOpen
mixerSetControlDetails
timeEndPeriod
timeGetTime
mixerClose
mixerGetNumDevs
mixerGetControlDetailsA

wsock32

getsockopt
listen
accept
WSACleanup
sendto
setsockopt
htons
WSAGetLastError
ioctlsocket
ntohl
recvfrom
WSAStartup
connect
getsockname
gethostname
inet_ntoa
send
gethostbyname
closesocket
socket
bind
recv
WSAAsyncSelect

mss32

_AIL_set_sample_3D_distances@16
_AIL_speaker_configuration@20
_AIL_stream_sample_handle@4
_AIL_open_stream@12
_AIL_digital_CPU_percent@4
_AIL_sample_3D_position@16
_AIL_startup@0
_AIL_set_stream_ms_position@8
_AIL_open_digital_driver@16
_AIL_stream_status@4
_AIL_sample_playback_rate@4
_AIL_set_speaker_configuration@16
_AIL_open_filter@8
_AIL_end_sample@4
_AIL_set_sample_volume_levels@12
_AIL_find_filter@8
_AIL_sample_status@4
_AIL_set_sample_3D_position@16
_AIL_sample_volume_pan@12
_AIL_sample_stage_property@24
_AIL_set_sample_channel_levels@12
_AIL_sample_ms_position@12
_AIL_WAV_info@8
_AIL_process_digital_audio@24
_AIL_init_sample@12
_AIL_stream_info@20
_AIL_set_sample_ms_position@8
_AIL_set_preference@8
_AIL_set_stream_loop_count@8
_AIL_set_sample_playback_rate@8
_AIL_size_processed_digital_audio@16
_AIL_stream_ms_position@12
_AIL_set_digital_master_reverb_levels@12
_AIL_stop_sample@4
_AIL_sample_volume_levels@12
_AIL_sample_channel_levels@8
_AIL_pause_stream@8
_AIL_set_3D_distance_factor@8
_AIL_allocate_sample_handle@4
_AIL_last_error@0
_AIL_set_sample_info@8
_AIL_set_file_callbacks@16
_AIL_resume_sample@4
_AIL_set_3D_rolloff_factor@8
_AIL_set_room_type@8
_AIL_set_sample_reverb_levels@12
_AIL_shutdown@0
_AIL_set_redist_directory@4
_AIL_close_stream@4
_AIL_set_sample_processor@12
_AIL_set_DirectSound_HWND@8
_AIL_set_sample_loop_count@8

binkw32

_BinkGetFrameBuffersInfo@8
_BinkPause@8
_BinkClose@4
_BinkGetError@0
_BinkOpen@8
_BinkSetSoundTrack@8
_BinkOpenMiles@4
_BinkControlBackgroundIO@8
_BinkSetMixBinVolumes@20
_BinkDoFrame@4
_BinkSetIOSize@4
_BinkSetMemory@8
_BinkRegisterFrameBuffers@8
_BinkWait@4
_BinkGetRealtime@12
_BinkNextFrame@4
_BinkGetRects@8
_BinkSetSoundSystem@8

d3d9

Direct3DCreate9

d3dx9_34

D3DXCompileShader
D3DXGetShaderConstantTable
D3DXGetShaderInputSemantics
D3DXGetShaderOutputSemantics
D3DXCreateBuffer

dsound

ord6
ord11

kernel32

SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FlushFileBuffers
HeapSize
GetTimeZoneInformation
SetFilePointer
GetFileType
SetHandleCount
GetConsoleMode
GetConsoleCP
GetStdHandle
DeleteCriticalSection
HeapCreate
HeapDestroy
LCMapStringW
MultiByteToWideChar
WideCharToMultiByte
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetDateFormatA
GetTimeFormatA
GetStartupInfoA
GetProcessHeap
GetCommandLineA
GetFullPathNameA
CreateDirectoryA
FileTimeToLocalFileTime
FileTimeToSystemTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
ExitProcess
HeapReAlloc
RtlUnwind
HeapAlloc
MoveFileA
HeapFree
GetSystemTimeAsFileTime
GetSystemTime
FindClose
SetStdHandle
RemoveDirectoryA
SystemTimeToFileTime
FindFirstFileA
FindNextFileA
GetTickCount
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
InterlockedCompareExchange
InterlockedExchangeAdd
GetLastError
ReadFileEx
GetFileSize
InterlockedIncrement
CloseHandle
SleepEx
CreateFileA
InterlockedDecrement
InterlockedExchange
SetThreadPriority
RaiseException
ResetEvent
GetProcessAffinityMask
GetCurrentProcess
GetCurrentThreadId
SetThreadAffinityMask
WaitForSingleObject
DuplicateHandle
SetEvent
SuspendThread
ResumeThread
GetCurrentThread
CreateThread
Sleep
CreateEventA
GetFileAttributesA
SetFileAttributesA
VirtualFree
VirtualAlloc
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameA
GetModuleHandleA
SetProcessAffinityMask
GlobalMemoryStatus
GetProcAddress
GetThreadPriority
GetCurrentDirectoryA
CreateToolhelp32Snapshot
Module32Next
GetVersionExA
GetCurrentProcessId
DeleteFileA
CreateProcessA
SetErrorMode
ReadFile
GlobalSize
GlobalUnlock
GlobalLock
Module32First
FormatMessageA
WriteFile
GetDriveTypeA
OpenProcess
MulDiv
SetPriorityClass
SetThreadExecutionState
LoadLibraryA
FreeLibrary
SetEnvironmentVariableW
CompareFileTime
VirtualQuery

user32

SetWindowLongA
GetActiveWindow
MessageBoxA
ClientToScreen
PostMessageA
GetCursorPos
SetCursorPos
GetForegroundWindow
ShowCursor
SetFocus
GetWindowRect
ScreenToClient
PeekMessageA
GetClipboardData
CloseClipboard
GetMessageA
LoadCursorA
OpenClipboard
TranslateMessage
DispatchMessageA
ShowWindow
LoadIconA
RegisterClassExA
DestroyWindow
RegisterClassA
GetWindowLongA
UpdateWindow
LoadImageA
GetSystemMetrics
SetWindowPos
DefWindowProcA
CreateWindowExA
SendMessageA
PostQuitMessage
CallWindowProcA
CloseWindow
SetWindowTextA
MoveWindow
MonitorFromWindow
MapVirtualKeyA
GetMonitorInfoA
RegisterWindowMessageA
ChangeDisplaySettingsA
EnumThreadWindows
GetDC
GetWindowTextA
UnregisterClassA
KillTimer
SetTimer
AdjustWindowRectEx
MonitorFromPoint
IsWindow
EnumDisplayMonitors
ReleaseDC
AdjustWindowRect
GetDesktopWindow

gdi32

CreateFontA
CreateSolidBrush
GetDeviceCaps
SetDeviceGammaRamp

advapi32

RegQueryValueExA
GetUserNameA
RegSetValueExA
RegOpenKeyA
RegCreateKeyA
RegCloseKey

shell32

ShellExecuteA

ddraw

DirectDrawCreateEx
DirectDrawEnumerateExA

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 552KB - Virtual size: 550KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 210.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 33B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5d68b14890e52aa2fa37841db44d8d1f

Headers

File Characteristics

PDB Paths

Imports

winmm

wsock32

mss32

binkw32

d3d9

d3dx9_34

dsound

kernel32

user32

gdi32

advapi32

shell32

ddraw

Sections

.text Size: 2.6MB - Virtual size: 2.6MB

.rdata Size: 552KB - Virtual size: 550KB

.data Size: 64KB - Virtual size: 210.1MB

.tls Size: 4KB - Virtual size: 33B

.rsrc Size: 4KB - Virtual size: 3KB

.text
Size: 2.6MB - Virtual size: 2.6MB

.rdata
Size: 552KB - Virtual size: 550KB

.data
Size: 64KB - Virtual size: 210.1MB

.tls
Size: 4KB - Virtual size: 33B

.rsrc
Size: 4KB - Virtual size: 3KB