�Z�d�ZAV�I���I�:�@�sw���4ӹ��=�+~S��"Q��B����e��YO~?����O�����\<��9W��v$���C���%X�e�4>s�F�|��p��]��Y�5�:@]�kRV輍YBŘ��}�{�%��g�#�s�- ^@ь�F4G��6����.[?u/���>�Bw����[�2R��5š?B�o\�Kڸ�"�-���$`ΟЊON\ͦFl%�j_É�j[�m��f9����xi��s���8��k�{�w�29�/�H�mBp���>W%8K�!�ޜH�@���Cl���>a���,->z�y`B���#���P��Ay��@>�"p�����d���PQ-�D��^�pM���c�����&���-hO�DZ9��/��|L��G�7bQ H��p�<�i�?�����j[(�2��~�����M���c�ݧ%BG%�>��\n�q��6ֲ��>���"�^� @j�Y�?�q�^q�3_���B���/�S��P越��6�c�������%��4Bj�����H���!K\ي����|���ޯK˧H��m�������yPd��\�?��ҀMϚ�j�&�5�c��wZ��e���}��>1�3�\G��a����,�~i!Y�nk6�W�7d��o��jO^�y>���Ѻ̓���ߑ,s��W��{Q��C��ܜ��i�^�88 -%=,(nZ�Y��.��?Ͽ�����"K���[��mw������]r@��� Z��G���E�L*���� �qjf�ܝ�VbΪXO5��8&�H��@�b����ۂP��\Cr M�/���>&f�Jo#�K :X댚��b���WO�sU2�����Z-��ko�����u�؆8���3�&f��_4��OH�]�����<�X78_dA^c����Bvf��6Tx�{A���d2��x�J�����<D3nO�[x���?�z�LM|��Q����ք4h��:��ȯ<��)��Y��F������'����������A�b�w�L��Q,#���������%.��7���iO}i�T�']��{!0B�*��=�#��Q�����h]6c�,�g�,����b�ۗ��d�O���oJ �x�ꞎ���u�y2��j2�p �"K��M������*��Ǯ���\��Z��'AH�ϭC�M�Q~k������ ����ʥJ�CRA|& �z�g��@#��ӃZ�`�-�6����]{�xF�+j|#c=�j��ʥˑ�O���G����B��kc��C��g��g�O'v~P"��_I�c�佸%&�Y����j����(@On��旃�;��\�lOΔ V��=�«������7BȦ�r)1��pa�2���,����@cZ�w� I>�k�% 5�<��6�'�a��=uw����A�St*St��*\f8�6��\�N�a�F�R$�HD��-(��[ �fl"��9���,�8� ��y����B�j�Y�eꝕª]2�'!��z���Vw��lB%�{�Α���P�4��Qұ�h�ѢY,F���~V㖩+ȸY1�#���D�������tH#P�!�eG�+�l���� �B��@&�s���H����th�zx�\�x��G eS8�vzTr�͎q���@#��g�x�v�a���?˔v�+����� �����q���"p�`�@�)>�)R|4���_\���S���c谑[.���F�E���f52[�����̟��(���H���5$�T��ZP��[έ�1�����'j�L_����Y|��������Ǔ��m�K"� W��������� QT���tnb*Y�rd*� �Gd�)O�d�����E�h2��InnE�CmO:����M�����������be�g��B �DBb�U]�0˅�4+s�J}��b�u���v� q��^/�#���0��O.����lf����و����3�����H��h��k'G�g�@�:�qTM���X��Nw.C��$Y]b�҇�-&������F^@�cQC��>2�08g�c�4�j�H"*u��v�;��S�v��4�~چ����`�~B��c& �w=�:�hr�Fs�+�2��� *�}��m��P_ܘɘ����_$ޓ̦T �s�SՌ�R���>r2��FqV��<�@�5�|ؕ�G�N��i��u^�sd��l'�o����e݀���Y37��D�A�r�X�t�P֯G1.��q\2�ÃL��~M]%V|���g��R�X/������>��=Nչ�����KiϽ�^���dY��?�= ���-WJ̚�T+���=� ��*�8��FoZh�ʚ2��1�R�%� �������b��_�R��I��KAz#t�D���E�a �Q�����؆�Mze#,͆[q�\5Twb~�<Q�˨����C�\�tp�kc6N�YQY���3Q�c�J�aS����u��z=��e�ז� �ϝ��xu��]�(�59�F�L�a�]�m&%�.�;��9\4�s�*+?:�Z���/�r&ٚ ���SF�K�<k���:<Ӊ�i&�v_]�<���N>�J���@��6�q}z�[�:5�NH���q���0���k?�ԫ#�Ӷ�\����j��U�IM��������Hxn�^��9��c���r9{�s����-H2N9`dP��YL���:�A�7�{[�v�!%���%V)h^�+b��:S`}%��e��@�t�?����}��Qz�|�H�����'��'�RY�)��S�� t��m_�����8c���?���`<W���E�� pUj<��P�ZdF�Bh6|7�� ��� �pv�Ա`�i���;ٔ��yV!.��cZ��^![��j)gx+���[��K��V�hX��Uq�8��ߣf=����L?c�`ہt^mh:OkP-�d媜Tԛ��7�!���U�s%���Oq����z��w��]Rc��"�g���Bfh����=�r�{�6�Hf���=�J>�=�A��E�2��Wj����S�#� �3k�|��?��1CJEL��s;�Bt��N���*lq֝��P�-��'�4��C���z����0���1�f��t� cCG�����A "�#kFGeD>rL�{ݮ@A�=��[��`Trb��-�p�!y�����t9�0[�?_� ����Qv�ý���{�ܒ�]�]��9 �`�����Þ���k��셁N^z���GpH��M��QxH�J֢C����i���fE�撻2����!gEuO9i���cΌV�|^!�LN7"��ͣf��ȟp�>���L�B�f��Lʢn��(.����|֤��M�Z��^2�y�j;��[)"~���W�1!>�;�^�J`lZ�P�����e5�/���.� �>T� �sx�n�'����@��E[������)����A�*������G�ο9eԨE:B����8��݆;Գ���@~A$�,z��b,�6Z�v������-��[4�0�j"X{���$���`�� ��y�M�%}�N�di�)ƣ~��m�P�㈯�EC.��i/bo��^EB?%�)��2�sW����K���D�e��[�ݐ��a_����'��;�j�Qd��h�r tZ�Y����=.�+��!�����RT��4�Elu���jVv_i���_�ʛ��% �Kf[G������gT�jQ-z��q\@e�XTY���h6"۽z�Dњ�=�i��
Static task
static1
Behavioral task
behavioral1
Sample
MW2.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
MW2.exe
Resource
win10v2004-20240226-en
General
-
Target
MW2.exe
-
Size
6.5MB
-
MD5
40ba1d11e5524c61917f1b391baac438
-
SHA1
940523dd93a68553cdcc014be93f2a1371f1f608
-
SHA256
87276edda9a937071223c26e7efec4c76814906f17b80adf4c15b26a6ed6c799
-
SHA512
1c2fa633c3a14d3528ea639ac59d0f1a507e22d891c2fa1d3bd072a08c70eeb9ccb0197d03e8637056bf9707bb6493bf27de4ad2870e26a01fc0d106d5450eec
-
SSDEEP
196608:KlP1HDVByoedJ2zXoC3TS+h5safWXlwN:GHD/yxdJ2HTS+7safWVw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource MW2.exe
Files
-
MW2.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Exports
Exports
Sections
Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4.1MB - Virtual size: 5.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE