���[n����?�R���fy<*��� D��%�>],�0`L��<��ѯ )#/CD�� �@6ԙ�Ui�� i��oAd��-r�,�^��ן��J6�:T�_c�Ǥ��r�� ��GT�?�'�`R���/�lb'�?Y.@yVEЭ�,��6��^��c�ڵ+���_�^vG�91N�:�{g�6Q2��/�0�t�BL�f؉sY�2�uU��˼�+�2a��` ��;��r.�V�bsa�Q�&���|���c��{��Ys�+�_KD�t�Q���W����^�s� �� 6�Qv ����a�,7E�)3����<�mBO��s���l7c�O�� /a�zE�;�L������L5�՛t@�֦���ܘ~�z��5��[����;�W�����]V ñ�x����qxbs�*�'��)�b T��!<���u���d9%\G)�]��~wL�4 �ƺ�����ي|Ҋ�}���ノ�DF_��%,>Sm���-Q�h�?j�zW�#]ד�@�b�ލf��������[�'��I���|��r���L��&Yo���l�!�� �&��T$O���b���Ā#wOu����:\!��}Sأ2GJ"�/U�87�Jm�Z�4�^����{�K+ڗ�4���{jdѫ�Q,>Q{ݯ�ήJ�H̡�l~6�|�.]�[zؚ�*{��RI�!��U��\Z���@�b��U��i3���mh.����!3Z8/�u}��Su�`̂`�7���Cb�!�S+cl%�;W�/ߴ`���5n���)�_�KE��K��19�F�\�tY��xt����3P�i'u-�fk�d_�=B��Ֆ|�Mn �ԟ�a�,Z��m��|"�%��.�J�ے��$������ZO��Ӡ_كO�Ffm���"���`>[P�I�UL�㭗�/��$+M�%A=�ܟ-��K˨!�2km���7jt�!����{�_TkW�)���ȿ�E�[p0�k7�h}U����|7��f�S��ۢ������.��k(|�;%-�0�nUnr�(������t��O�c� �vV��qq��>��ɶ/�f��G=�� ��W1�� ���#`䕺�F/���Y1�Ig**���,K��{G���ԇ��-A4v&�b@j��A��YǵX/�Idz"M�<}�g��5�pt�*��Y�X���{��y#�ۜN��AW94����TsRf-I��G˨UU�^t�*�k���Nd��ID�U/�5�.�2�<zQ�Y$b?��-O�z�7I�T���?�.��Riq�.Y���lt�@�C�+���kJ�蓒�cX�/d�/+$(oFVcYV���>+����l�3�Bz��y����R(�|��Vadj�{�5͞���Y�=`�Vɋ�Cnž�"^"w b�&>�6�����c��"g����*Ɂs�@^mpI}Ȏ쇅����73ƾ�'s�$��(�`�Q��C���}��2��>���PR}���9���Y�5�2vP��H�l�sjD�&� ���5�*���ǣs�x�̮�R���A��h�B�:Љt"��"������t�p�<a҄<p���"ә2���B���ir{ 0�4W�Į���}L���'� ���u��n mжPkE��<�+� �2��%_�;9Y�T�E:�����wX��+%;.����L)^���⚽.���G8�,߇��Z H�R#�Ǽ�����.��z��M����� ���5Q��W���0=x��2���,�����(\]H��� Z��2)�>y�?@��? Wc��dYm2���"�/>�����9�����&VJG¿o� �]��r����r��̝[��x��Z֟1�pދt"`�.}8����'�Dp"T���GR �k��x"��X����a�`�(~��q�^��b��a�)bz�#W��i��O�� �����L�|J���߉�� �UU�h�I�z1da��i�L�]�Pon�1;@��i�G��5�>?�a����'��f�qVQ��e��;�����I�M�3 TԊ�#�=sŤ�sFO��@��9�H&'�-��.l�� �c> �x�U�0]����R�^�@ʡ���B����3��>��_ñ��]B��,� yg���<��=lM|���&5���!�Giy�d�L��;�l�W�%.XVJ9ɯH��m��h��T/c+M����7ex�oW3���+�GW����) x~,x�C�[�Sr=z爪��s'1�Z{1�`�Զ_q�ƨk��P:*fW���l҂X��x��7=��V�v(��F�(ճ�{� �8bIێ��t�`4n�fGI@Ji�X�Ur�F)��6Tm�Z��܁#Ͳ[��P�i#����)�Oؼi �Z��0��Aa����d�<o'B��eu5ԋ�(a1�&k�`-n��o������2���C�_��3��4��+2��W����9�46�����&s�0�{T�V[����KrǴ�a�*d쯊)&)�\iS�2�i��S�c+�ci��q���^�tt�7���p��5��l��|W�z9�*!Ӣ4��1�&���F�E����2a܆=��|���=���Û�X���'��7��I�h��t����Q+6��-<�t|��}N_*�ɑ��a`j��ԯ���Q7��K�`���ЬufE"F�����۽1���^u2��q�����RIb�������(�E���3;l��8�V,9��y��鴆�ڎ {��rL�Z؝P8BP�X�mns�vQ ��T�_�?u3w�b�z�:��l(����ZF�pk`����5e��5��E-'��(���';�{�Zacz4�&�����}B#�� �n�5i8z$�d���pqJ3GY���B����wk�,�M�ئw*R@j�9�h���`©g+�P�.����k�?]z{��������!�B�������Sl��|Nŭ�� s��g%r��e�Q�08!E��A�Sd�%v�$w���j�= Z�8JbϷ��� G)M^r��`���N�e'"�n��Q�=�dM>�T,��=$�E:�,��������f�l��Dg�ϔ���p�Qa��:��K�D(���O��;e�����ػ�-
Static task
static1
Behavioral task
behavioral1
Sample
COD_WZ__MW3_NO_BLOCKER_.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
COD_WZ__MW3_NO_BLOCKER_.exe
Resource
win10v2004-20240426-en
General
-
Target
COD_WZ__MW3_NO_BLOCKER_.exe
-
Size
5.8MB
-
MD5
31389909564c48171eaa718520e6fcc3
-
SHA1
ea9a2bf49e1bdb18de18dfc038170186afa52233
-
SHA256
ec84888441e7ce8461919a0be2d4a299db9ae811edb225c7ae343940aac32af9
-
SHA512
6870d8d4bdac3dd92171d27b21247e0a388598f5e220c3f2d5da5ad8ac8595e89542717be2ccb283c10dda877a8dbe5445632bfa9a78a852738babefa1b1ca55
-
SSDEEP
98304:YgMpB2Fc44Bo/jtPgU0u1lAi9vdUrA/JDQwn9OLBuGkHNGOexPobqAd7Fm:jE0DAo/j12kIKDQq9c8RpmPouA9E
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource COD_WZ__MW3_NO_BLOCKER_.exe
Files
-
COD_WZ__MW3_NO_BLOCKER_.exe.exe windows:6 windows x64 arch:x64
0c3ccb0cdb0dc339a91db138d289b391
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
LoadLibraryW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
shell32
ShellExecuteW
msvcp140
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
ntdll
RtlLookupFunctionEntry
normaliz
IdnToAscii
wldap32
ord143
crypt32
CertFreeCertificateChain
ws2_32
closesocket
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-string-l1-1-0
strcpy_s
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-filesystem-l1-1-0
_stat64
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
_dclass
advapi32
AddAccessAllowedAce
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 526KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 186KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 278KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.COD0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.COD1 Size: 5.8MB - Virtual size: 5.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ