�n Ad9�c����&�g��M�Cv�3rm7��)�t�@�!�Ng���b^��[$ώ@���h�o�݃Т���V5rOO�����gх�\ڇw7��#z~<�|��crq;Ղ���^�^qē�u'Q�QV�m��ݿ6��.�~�q��}� HP%Fq�+���n����._�f����狪�.�5C���m�^S�$�y��T̢�̧������I�Hj �E�=O�*,��dÃ%�亨�@�V�OkrZ�"'ku�K��b�==���t���8�z�����0���'T:�BA���ߐ�vb�6�a�������Y� :�PW�� L�QK{��٩���ɤ�ܨGO�R���橷�b�7�2)���:^���~��r`hc��Z�uh�3�$t���;(x�p�.�6-q[����܂�{?O& jl��>@苐�Ϗ�y���⡤N0Ҟ�&�ko�韒b��-VLb�%Z� Z� �q}w*w�_��G�9�y&���z�gA�Vڝ�0^n������N�M��]�x�f<\a �k��C��O�U�-q����$��e*��Aq�4��kkq�2�@�_q�����Gw�*QW�������K��C��:N��ܖ�75��#�0<?c�?�+y��$�CsN%���/9d�{t�ĨY��i,�ү'�B<CX�(g�{����C�~O}m��W�v;8��T���[�4=�y�t������H3�9�9�_J�G�ڒg2o�_/J����?��>ځ��9�ӣ�[�ၒ*v����"����N�Z$ C�Ҏ���a4�f�`�)٫���5Z��>a�o�??#��o��I%��ٰ`�hW�#��XD�a%i&_�>Z���왱.���D.l�%h���7e��_��_����l�:�m��J!ɟ�^v/�Ș�]#!à8:���:�����w���x]��OtnIqDR�/��D��v���)��`i�H��Z�>�&�w��hT�w~l��!hO��DR��,�1�Դ�~!`�nq�����j��!t�Z�E�����{l*�����S�����[����'������F*5V�����o�.����&��*r�V�%J���3�{#a�K,\��%�m������˚�_���M��.f�ꎮ_�=����U�[�O�j4��� Ȳ~�!��8��'k�q|����њ��dB����^r��q����T��k9�e�r�5(Q�0?��@'���� ���kGT����.1�|����N� �/����Ֆ�н�-�:&C�>ږO^J�g�����HuȬ�%���(���B��i���:m�pIW�,o����#��"Z� T���4��� 3+��~��/#D�c3d�-�J ttD����!o��P��Ww����5yҪ1v��������L.���,m���/�=�wѼ���k��z�d��#�]9�5:Ŗ>]LB�gE�1캉y@j^��ry'r?T��!�6�[�Fc`j�ruN"N����:#��ɋ��ѧ���S�]�K�<�H��~��-~{QB��>ωL8w��k#�:b�� Ĥr����n����|C�ԾnVA�뿋X �+���- �>���l����&��X�a�tF�QDh���6���:þ����mɁYp��3�\G�>,�Sn݇���`��d����`Սt ��M [ث/�l2#�vew�W�����*iV+E���3��^F�3٭K�� ���=qV��@g)c����0/�lEwѽ���xxL�~���T�f$�x���p��C�2@Xv���c����[�F��ė�%��/AGr*��O�>��pjKT����3~�;�"N&�A���ՠ�&�h���}�R�$ț��ؿy�mb�� �I��dݬv~���ˣ<�K"�a����r�L;L��B�{a���,�+����{�u��un7@S�$,�Y�L �����Qg��W����0�4���.�H�ȁ/��5�q��O�?�_�E|�7�\���.��#� ����b�C�9���i�'�Zñi���U�8��D���$T�8-h Yp-ޏ��Twxg|9�,��i�)���?V}�Ь���%{=�RZ(��J�4q�H���!daBӝ��]G&6�X\����]C�l0�=yB#y�%�"��`�*����/.Y3c�K��U�6QS7���յ��#����a�Cf�O��$-o9��ԃ|��j�����Ϣٺ f̠�V���}Y����x��N�*nj*z��"���eKNl����Iu�[���Ąz�8�%E�� Q����6mȃ5㎨�d�t��E�8������d��Jt��G%�.����ya���W�t����X�0D��I���]Q@���ʯکr�Ҽ�Z��9&�j���<�������@Z��+��P�J��s�6=����EP s1����N�ʓ�L%I�f!$�����#6>��n2�b�.6'��5�hd۬n��)�D�$A�؎~e��d�����������﹀�����Ə�2��, �r�*�P�-؛�$�J�3:"_X]���G�� ZH����߾+>� Q��,� A*�r���!�痰iu ���q���%�*��2��Ş�+i�@o�*VV�iM���5�����%I��;��7>(6(��j��qR\dNe�J �<��y�&8�#\Zߣ�X�+P~���]�8�}�X�lUVWeo5p�#�R!4�Քu�7Ԟ|���.b.˩�xÛ���p!=�wQEt��ˡJg6�$+}����yF%g�(9��.�:>�K��x.1�A��w�ULs! ����}g5�c�)�D��2K�B��L��ή��U�����AU1 ����2�4ὴNmF�l����b__�f��z<�>W������|��$�TturX0�e�φ�G-��9$֛<.I6OHd`a,����t��\J~GQ\I�^�;�M�#=�2�I���%VU7��h�C�xaT��`b|!s�1��_����[ǩ`ax��U:�/J�'~_�ya����;��A��K��)n�Ӟ�a-<���4�E ���sz��ћg�Įb�( ��xAPJ���O\� ���������GL�Pb
Static task
static1
Behavioral task
behavioral1
Sample
MW3FS_BlockerV1.3.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
MW3FS_BlockerV1.3.exe
Resource
win10v2004-20240419-en
General
-
Target
MW3FS_BlockerV1.3.exe
-
Size
16.3MB
-
MD5
5a8db194303d50378087de68eed54eaa
-
SHA1
53466aa75485b83a6d3e77c5b637bbbb0d2e83ef
-
SHA256
7e419bd7ea2ddb7a1bc43290fc17622cb4c3688b777d77c099201e868a0ffe5f
-
SHA512
ba0cd1de6df77fa152112989102e7886cdebfa956d5da181ced27f0960fa632dd51bc9cb5a769527d925cfe6230cd7122aafc6ab332fa44f043797f9c091901f
-
SSDEEP
393216:ZqCFzpnA5jjvGY20nkaCZ1mR9OkUVZ2/DJ95NZbPqOVEFPs:ZqCDnA5nYh1mX6ZcDnlLm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource MW3FS_BlockerV1.3.exe
Files
-
MW3FS_BlockerV1.3.exe.exe windows:6 windows x64 arch:x64
949f9f01944b286d94a4b1af19635108
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
IsDebuggerPresent
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
PostMessageA
CharUpperBuffW
advapi32
CryptDestroyHash
shell32
ShellExecuteA
msvcp140
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
ntdll
RtlCaptureContext
normaliz
IdnToAscii
wldap32
ord41
crypt32
CertFreeCertificateChain
ws2_32
htons
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-runtime-l1-1-0
_getpid
api-ms-win-crt-stdio-l1-1-0
_write
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-locale-l1-1-0
localeconv
Exports
Exports
Sections
.text Size: - Virtual size: 518KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 322KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.r?A Size: - Virtual size: 13.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.0;| Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.C![ Size: 16.3MB - Virtual size: 16.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ