mw3[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
mw3.exe
Size 3.8MB
Sample260810-kd64jafa28
SHA256 f05e79442b2ee0fcda6ac319ecd0d1c45a56bbe418a0fcdc40209daee95dea67
MD5 9242ad20db1fd0c62011d4614a082adc
SHA1 0bcf53e543bba239baeb0ab6500a21326a3a8933
SHA512 de7f6b86d5cc462ee32aab15e9020644cdeeedbe31427d6ebd31dcd5c9e447e2eaa39418d4a6d6aca9c688480c91a434594eb3ee594a1b69a7b7b432d67ab987
SSDEEP 49152:129BvtchdTOZVZGdzvchdTOZVZGdzSyw:129Xc3UVevc3UVe
TLSH
T103064A1AC6ED985FE1F662B592441970C0A1DAE7810EC8DE319E7FECDD66C006D18ECB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mw3.exe

File Explorer

mw3.exe

.exe 3.8MB

mw3.exe

IMPHASH b8b5ac615ce365834b0db9f580768c0f
SHA256 f05e79442b2ee0fcda6ac319ecd0d1c45a56bbe418a0fcdc40209daee95dea67
MD5 9242ad20db1fd0c62011d4614a082adc
SHA1 0bcf53e543bba239baeb0ab6500a21326a3a8933
SHA512 de7f6b86d5cc462ee32aab15e9020644cdeeedbe31427d6ebd31dcd5c9e447e2eaa39418d4a6d6aca9c688480c91a434594eb3ee594a1b69a7b7b432d67ab987
SSDEEP 49152:129BvtchdTOZVZGdzvchdTOZVZGdzSyw:129Xc3UVevc3UVe
TLSH
T103064A1AC6ED985FE1F662B592441970C0A1DAE7810EC8DE319E7FECDD66C006D18ECB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3874816

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

DeviceIoControl CreateFileW CloseHandle ReadFile VirtualFree GetCurrentProcess WriteFile VirtualAlloc LoadLibraryExA CreateToolhelp32Snapshot Sleep GetLastError Process32NextW LoadLibraryA DeleteFileW Process32FirstW LoadLibraryW GetWindowsDirectoryW GetProcAddress GetFileSize FreeLibrary WriteConsoleW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType WaitForSingleObject GetExitCodeProcess CreateProcessW GetFileAttributesExW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc RtlUnwind

user32

SetWindowsHookExA UnhookWindowsHookEx EnumWindows PostThreadMessageA GetWindowThreadProcessId IsWindowVisible

shell32

ShellExecuteW

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlImageNtHeader

Name

.text

Size

204KB

Virtual Size

203KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

77KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rcd7cb

Size

112KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

mw3.exe

kernel32

user32

shell32

ntdll

generic