Behavioral task
behavioral1
Sample
unpacked_MW3 VIP CHAIR.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
unpacked_MW3 VIP CHAIR.exe
Resource
win10v2004-20240802-en
General
-
Target
unpacked_MW3 VIP CHAIR.exe
-
Size
14.5MB
-
MD5
4f947ef1f56c2e35aa17cb1ad241e5ed
-
SHA1
4e387541691f4804934e87c0197d55f1404215fe
-
SHA256
eb070b62380f8640f3670b6fd3f6fffd7361e85ecae06d6208114c6431df2a4a
-
SHA512
529021a45e931d0d1c54d2c516aff54c8bcd939f958ac0ebe6a890ff0cacd217dead48c379c117e2bcde6653699d7696a9c720af7d935ae1972e847525c331cb
-
SSDEEP
196608:pIsEmxFyTU3CvfzzgmNJYf/ilWcaW26cIOStZ/Pk1:pIsEm3YU3Gfz7NK3ilWghs
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpacked_MW3 VIP CHAIR.exe
Files
-
unpacked_MW3 VIP CHAIR.exe.exe windows:6 windows x64 arch:x64
d19bb9e82d851a1173910b0d0663b36c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
CryptCreateHash
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
CloseServiceHandle
OpenSCManagerA
OpenServiceA
QueryServiceStatusEx
RegCreateKeyW
RegOpenKeyW
RegSetKeyValueW
RegDeleteTreeW
AddAccessAllowedAce
GetLengthSid
GetTokenInformation
InitializeAcl
IsValidSid
SetSecurityInfo
CopySid
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
OpenProcessToken
CryptGetHashParam
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
ConvertSidToStringSidA
crypt32
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CertOpenStore
kernel32
CreateThread
VirtualProtect
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameA
QueryFullProcessImageNameW
lstrlenA
SetPriorityClass
GetConsoleMode
SetConsoleMode
GetConsoleCursorInfo
SetConsoleCursorInfo
GetConsoleScreenBufferInfoEx
SetConsoleScreenBufferInfoEx
GetConsoleWindow
FormatMessageA
LocalFree
EnterCriticalSection
LeaveCriticalSection
SleepEx
VerSetConditionMask
QueryPerformanceFrequency
GetSystemDirectoryA
FreeLibrary
InitializeCriticalSectionEx
QueryPerformanceCounter
GetTickCount
MoveFileExA
WaitForSingleObjectEx
MultiByteToWideChar
GetEnvironmentVariableA
GetFileType
PeekNamedPipe
WaitForMultipleObjects
GetFileSizeEx
WideCharToMultiByte
GetProcessHeap
GetSystemTimeAsFileTime
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetTempPathW
Process32Next
Process32First
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
GlobalFindAtomA
GlobalAddAtomA
LoadLibraryA
LoadLibraryExA
GetModuleHandleW
VirtualFreeEx
WriteProcessMemory
ReadProcessMemory
VirtualProtectEx
VirtualAllocEx
OpenProcess
CreateProcessA
GetCurrentThread
CreateRemoteThread
GetExitCodeProcess
GetCurrentProcess
Sleep
WaitForSingleObject
SetLastError
SleepConditionVariableSRW
WakeAllConditionVariable
GetLastError
SetUnhandledExceptionFilter
DebugBreak
ReadFile
DeleteCriticalSection
GetLocaleInfoEx
FindClose
GetStdHandle
RtlAddFunctionTable
GetProcAddress
GetModuleHandleA
VirtualFree
VirtualAlloc
GetCurrentThreadId
GetCurrentProcessId
DeviceIoControl
CloseHandle
CreateFileW
CreateFileA
InitializeSListHead
OutputDebugStringW
VerifyVersionInfoA
FindFirstFileW
GetFileAttributesExW
SetFileInformationByHandle
AreFileApisANSI
GetFileInformationByHandleEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
msvcp140
?do_encoding@?$codecvt@_SDU_Mbstatet@@@std@@MEBAHXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xbad_alloc@std@@YAXXZ
_Xtime_get_ticks
_Query_perf_counter
_Query_perf_frequency
_Thrd_detach
_Thrd_sleep
_Cnd_do_broadcast_at_thread_exit
?_Throw_Cpp_error@std@@YAXH@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAHH@Z
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_C_str@?$_Yarn@D@std@@QEBAPEBDXZ
??0facet@locale@std@@IEAA@_K@Z
??1?$codecvt@DDU_Mbstatet@@@std@@MEAA@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?is@?$ctype@D@std@@QEBA_NFD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$numpunct@D@std@@2V0locale@2@A
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?setf@ios_base@std@@QEAAHHH@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV?$basic_ios@DU?$char_traits@D@std@@@1@AEAV21@@Z@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Xbad_function_call@std@@YAXXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?do_encoding@?$codecvt@_SDU_Mbstatet@@@std@@MEBAHXZ
??4?$_Iosb@H@std@@QEAAAEAV01@$$QEAV01@@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?width@ios_base@std@@QEAA_J_J@Z
?width@ios_base@std@@QEBA_JXZ
?flags@ios_base@std@@QEBAHXZ
?good@ios_base@std@@QEBA_NXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??Bid@locale@std@@QEAA_KXZ
?uncaught_exceptions@std@@YAHXZ
?_Xout_of_range@std@@YAXPEBD@Z
??7ios_base@std@@QEBA_NXZ
normaliz
IdnToAscii
psapi
GetModuleInformation
rpcrt4
UuidToStringA
UuidCreate
RpcStringFreeA
shell32
ShellExecuteA
user32
PostMessageA
GetAsyncKeyState
GetWindowLongA
SetWindowLongA
SendInput
MessageBoxA
userenv
UnloadUserProfile
vcruntime140
strrchr
strchr
memcmp
strstr
__C_specific_handler
_purecall
memset
memcpy
__current_exception
__current_exception_context
memcpy
_CxxThrowException
__std_exception_destroy
__std_exception_copy
wcsstr
memchr
__std_terminate
vcruntime140_1
__CxxFrameHandler4
wininet
InternetCloseHandle
InternetOpenA
InternetOpenUrlA
InternetReadFile
wldap32
ldap_get_dnA
ldap_value_freeW
ldap_memfreeA
ldap_next_attributeA
ldap_first_attributeA
ldap_next_entry
ldap_first_entry
ldap_err2stringA
ldap_msgfree
ldap_search_sA
ldap_bind_sA
ber_free
ldap_get_values_lenA
ldap_simple_bind_sA
ldap_set_optionA
ldap_unbind_s
ldap_sslinitA
ldap_initA
ws2_32
htonl
accept
WSACleanup
WSAStartup
WSAIoctl
WSASetLastError
ioctlsocket
__WSAFDIsSet
select
getaddrinfo
FreeAddrInfoW
recvfrom
sendto
gethostname
htonl
setsockopt
htons
htons
getsockopt
getsockname
getpeername
connect
bind
WSAGetLastError
listen
closesocket
recv
send
socket
ucrtbase
strtoul
_strtoi64
strtol
strtod
atoi
_strtoui64
_fstat64
_lock_file
_unlock_file
_access
_wremove
_stat64
remove
_unlink
free
calloc
realloc
_callnewh
malloc
_set_new_mode
___lc_codepage_func
localeconv
_configthreadlocale
__setusermatherr
_dclass
_dclass
_dsign
_dsign
_fdsign
_fdclass
_mbsicmp
_errno
strerror
_getpid
__sys_nerr
abort
system
_invalid_parameter_noinfo
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
_resetstkoflw
_get_initial_narrow_environment
_initterm
_initterm_e
_Exit
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_beginthreadex
_invalid_parameter_noinfo_noreturn
terminate
exit
__stdio_common_vsprintf
__p__commode
_close
_open
_write
_read
_get_stream_buffer_pointers
fclose
_set_fmode
fflush
fgetc
fgetpos
fputc
fread
_lseeki64
fsetpos
_popen
_pclose
fgets
__acrt_iob_func
_fseeki64
fwrite
setvbuf
ftell
fseek
feof
ungetc
__stdio_common_vsscanf
fputs
fopen
__stdio_common_vfprintf
_mbsdup
tolower
_stricmp
strcmp
strncpy
strpbrk
strncmp
isupper
strcspn
strspn
_gmtime64
_localtime64_s
_time64
qsort
rand
srand
ntdll
RtlInitUnicodeString
NtQuerySystemInformation
Sections
.text Size: 755KB - Virtual size: 756KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 284KB - Virtual size: 300KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 47KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 27KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: 8.2MB - Virtual size: 8.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
.SCY Size: 16KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE