MoveMW3Chair[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
MoveMW3Chair.exe
Size 968KB
Sample240612-2vda8atfne
SHA256 dddd52286ba167e416065b1815c2630218213aa8dd95513e43ead3f8650a5dd4
MD5 0862ecc07ea6cd2325d941e50eeb4365
SHA1 fbec081fc7c779ab8b8087fcffbe1de170b6c460
SHA512 d347b64ef2d45d931f2d92b32d88ed0df531f57663fd91a51401becf1bbb4fd1d0c5b6b61ed74abe39938e3d49690674df62584bd3aacbc4ebc93b90063734c9
SSDEEP 24576:yrw3IPQfmHFpOHsnRKRP+bM+O93l0fZS:ZmlsQURd+O93+x
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MoveMW3Chair.exe

File Explorer

MoveMW3Chair.exe

.exe 968KB

MoveMW3Chair.exe

IMPHASH 36399e30e79d39720a6fe23be6e34a0f
SHA256 dddd52286ba167e416065b1815c2630218213aa8dd95513e43ead3f8650a5dd4
MD5 0862ecc07ea6cd2325d941e50eeb4365
SHA1 fbec081fc7c779ab8b8087fcffbe1de170b6c460
SHA512 d347b64ef2d45d931f2d92b32d88ed0df531f57663fd91a51401becf1bbb4fd1d0c5b6b61ed74abe39938e3d49690674df62584bd3aacbc4ebc93b90063734c9
SSDEEP 24576:yrw3IPQfmHFpOHsnRKRP+bM+O93l0fZS:ZmlsQURd+O93+x
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

511812

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\move\Desktop\MoveModz\Loader + Blocker\output\Loader.pdb

kernel32

Process32FirstW DeleteFileW LoadLibraryA CreateFileA Process32NextW Sleep CreateToolhelp32Snapshot LoadLibraryExA TerminateProcess WriteFile GetStdHandle GetCurrentProcess SetConsoleTextAttribute SetLastError ReadFile GetProcessHeap GetCurrentProcessId InitializeSListHead GetSystemTimeAsFileTime IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable DeleteCriticalSection ReleaseSRWLockExclusive OutputDebugStringW InitOnceBeginInitialize InitOnceComplete GetFileInformationByHandleEx GetWindowsDirectoryW SetFileInformationByHandle GetFileAttributesExW FindFirstFileW FindClose GetLocaleInfoEx WideCharToMultiByte GetFileSizeEx WaitForMultipleObjects PeekNamedPipe GetFileType GetEnvironmentVariableA MultiByteToWideChar WaitForSingleObjectEx MoveFileExA GetTickCount QueryPerformanceCounter VerifyVersionInfoA GetSystemDirectoryA QueryPerformanceFrequency SleepEx LeaveCriticalSection EnterCriticalSection LocalFree FormatMessageA GetModuleHandleW GetModuleFileNameA UnmapViewOfFile MapViewOfFile CreateFileMappingW VirtualProtect LoadLibraryW Beep FreeLibrary GetTempPathW IsDebuggerPresent SetConsoleTitleW QueryFullProcessImageNameW AreFileApisANSI HeapFree GetConsoleWindow GetProcAddress HeapDestroy HeapAlloc CloseHandle HeapReAlloc GetLastError HeapSize GetModuleHandleA GetCurrentThreadId CreateFileW InitializeCriticalSectionEx VirtualAlloc DeviceIoControl VirtualFree AcquireSRWLockExclusive

user32

SetWindowLongW PostThreadMessageW SetWindowsHookExW UnhookWindowsHookEx MessageBoxW SetWindowPos GetWindowThreadProcessId GetWindowLongW EnumWindows

advapi32

CryptEncrypt CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGenRandom CryptGetHashParam CryptReleaseContext CryptAcquireContextA ConvertSidToStringSidA CopySid SetSecurityInfo IsValidSid InitializeAcl RegOpenKeyW RegCreateKeyW RegDeleteTreeW OpenProcessToken AddAccessAllowedAce GetLengthSid GetTokenInformation RegCloseKey RegSetKeyValueW CryptImportKey

shell32

ShellExecuteW

msvcp140

?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z _Cnd_init_in_situ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?__ExceptionPtrCreate@@YAXPEAX@Z _Cnd_unregister_at_thread_exit ??0task_continuation_context@Concurrency@@AEAA@XZ ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z ?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ??Bid@locale@std@@QEAA_KXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z _Cnd_destroy_in_situ _Cnd_broadcast _Mtx_unlock _Xtime_get_ticks _Cnd_wait _Cnd_do_broadcast_at_thread_exit _Cnd_register_at_thread_exit _Mtx_init_in_situ ?__ExceptionPtrRethrow@@YAXPEBX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z _Mtx_lock ?__ExceptionPtrDestroy@@YAXPEAX@Z _Mtx_destroy_in_situ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Syserror_map@std@@YAPEBDH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Xbad_function_call@std@@YAXXZ ?_Winerror_map@std@@YAHH@Z ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?_Throw_Cpp_error@std@@YAXH@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xout_of_range@std@@YAXPEBD@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z

ntdll

VerSetConditionMask RtlInitUnicodeString RtlImageNtHeader NtQuerySystemInformation

normaliz

IdnToAscii

wldap32

ord143 ord217 ord46 ord211 ord60 ord45 ord50 ord41 ord22 ord26 ord27 ord32 ord33 ord35 ord79 ord30 ord200 ord301

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertOpenStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertAddCertificateContextToStore

ws2_32

closesocket recv send WSAGetLastError bind connect getpeername getsockname getsockopt htons ntohs socket WSASetLastError WSAIoctl WSAStartup WSACleanup accept htonl getaddrinfo ioctlsocket freeaddrinfo recvfrom sendto gethostname ntohl __WSAFDIsSet select setsockopt listen

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_purecall memset __std_terminate _CxxThrowException __std_exception_copy __std_exception_destroy memmove wcsstr __current_exception_context __current_exception __C_specific_handler strstr strrchr memcpy memcmp strchr memchr

api-ms-win-crt-stdio-l1-1-0

fsetpos fputs __stdio_common_vsscanf feof __acrt_iob_func fseek ftell fread ungetc fgetpos fwrite _lseeki64 __stdio_common_vsprintf _popen _pclose fgets fgetc fclose setvbuf fflush fputc _open _fseeki64 _close _write _read _get_stream_buffer_pointers __p__commode _set_fmode fopen

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc realloc malloc free _callnewh

api-ms-win-crt-utility-l1-1-0

rand qsort srand

api-ms-win-crt-filesystem-l1-1-0

_stat64 _access _unlink _unlock_file _fstat64 _lock_file _wremove

api-ms-win-crt-string-l1-1-0

strncpy isupper strncmp _strdup strcpy_s strspn _stricmp tolower strpbrk strcspn strcmp

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64 _localtime64

api-ms-win-crt-runtime-l1-1-0

__p___argv __p___argc _beginthreadex _c_exit _register_thread_local_exe_atexit_callback system _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv abort _errno _exit _initterm_e _initterm _getpid _get_initial_narrow_environment _invalid_parameter_noinfo_noreturn _register_onexit_function terminate _set_app_type _seh_filter_exe strerror __sys_nerr _cexit _invalid_parameter_noinfo _crt_atexit _resetstkoflw exit

api-ms-win-crt-convert-l1-1-0

strtoll strtod strtoull atoi strtoul strtol

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func localeconv _configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr _dclass