Static task
static1
General
-
Target
mw3+chair+blocked.zip
-
Size
11.2MB
-
MD5
585d4928a0759c8ec1d46072e7a9e279
-
SHA1
5da88e605f7f827e85669960e32bbd6f94d07bb9
-
SHA256
2826ac4dd1c7e59f710fb2d9945667c6cb5ac94ab20fd06e453f215fb1ea5782
-
SHA512
6a9cfbe11541f8d06fd37038f4b1a10cc90b16af79ba7943afbeee275b2bda7dc9636cb3bf98afd49244aa2e734c407abf2c4f940f979771062a294f758580ed
-
SSDEEP
196608:9UFcTLuElApqn4WvUqy4zMPVfDOv5Ya5/Ft96dUecsF2qFIaC8aSNLCb8LFbwtTb:6F6Ykn4WvUTAv5t5/Ft9/evFqa7//bwV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/mw3 chair blocked/MW3ChairBlocker2023.exe
Files
-
mw3+chair+blocked.zip.zip
Password: infected
-
mw3 chair blocked/MW3ChairBlocker2023.exe.exe windows:6 windows x64 arch:x64
Password: infected
71ad95ba370be2d81b654e3f21b886ad
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
HeapSize
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
UnhookWindowsHookEx
CharUpperBuffW
advapi32
CryptEncrypt
shell32
ShellExecuteW
msvcp140
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
ntdll
RtlLookupFunctionEntry
normaliz
IdnToAscii
wldap32
ord33
crypt32
CertCreateCertificateChainEngine
ws2_32
ntohs
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140
__std_terminate
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_resetstkoflw
api-ms-win-crt-string-l1-1-0
strcspn
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
__setusermatherr
Sections
.text Size: - Virtual size: 537KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 279KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Lr1 Size: - Virtual size: 8.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.7+C Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sNa Size: 11.3MB - Virtual size: 11.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 245KB - Virtual size: 245KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
mw3 chair blocked/crack.1337