Static task
static1
Behavioral task
behavioral1
Sample
MW3 Chair + Blocker (1).exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
MW3 Chair + Blocker (1).exe
Resource
win10v2004-20240704-en
General
-
Target
MW3 Chair + Blocker (1).exe
-
Size
10.5MB
-
MD5
1addab698e178bc44e23894799d1086b
-
SHA1
be27c5e138aa99fe62840f5eb94c5f286e8d8a6b
-
SHA256
554da1a91f18bc834e899b8a52a469b3cd2e9b0fc55181b94560702cb5164105
-
SHA512
4060320ae1cccf0951d7e705aea8ac0a25672f1681a34de0382abc0005b684b4c2d7b2882991f6b818c04edc32685bb450987883e99ca6cfec34f182f23bf57a
-
SSDEEP
196608:FBaucva2ZOwNBvP6mpmUIXQb4KMVRbA5zdJJVD6zi8:Dvcva2RNBn6ga3hiDDKH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource MW3 Chair + Blocker (1).exe
Files
-
MW3 Chair + Blocker (1).exe.exe windows:6 windows x64 arch:x64
fdbf326949b05d983075259e7135ce84
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
HeapSize
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
BlockInput
CharUpperBuffW
advapi32
CryptEncrypt
shell32
ShellExecuteW
msvcp140
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
ntdll
RtlLookupFunctionEntry
normaliz
IdnToAscii
wldap32
ord33
crypt32
CertFreeCertificateChainEngine
ws2_32
ntohs
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140
__std_terminate
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_resetstkoflw
api-ms-win-crt-string-l1-1-0
strcspn
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
__setusermatherr
Sections
.text Size: - Virtual size: 528KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 279KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uNj Size: - Virtual size: 7.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.wDs Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
..Q0 Size: 10.4MB - Virtual size: 10.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ