285_MW3-NET_Externa[.]rar

General

Target
285_MW3-NET_Externa.rar
Size 465KB
Sample260910-ajqcvssekc
SHA256 6763ffd406b3cf3b6e9bd632ce1a33bf25fe1362a58c321ec6e01cd79390ab4b
MD5 d2d6d1fe8cd25121a2ce91b3891d3236
SHA1 6758df9546a639176b30ad9990fec63198c7300e
SHA512 2d6746e509037cd8e6425a1946f4ed1aa25eff245cb41a8c143b44a6efc536c3aa3c02ab4988ac07fc84726b01f4623a389b88b701f2931415ad0c517359d05f
SSDEEP 12288:oIJC1k2xBWoKmFZirA8s4AXyB9u2rEDf0lIvGC/Ev:oESkqBWut8sbirEDf0lI+CMv
TLSH
T15CA423570D2BF6DE087A6E1B3958B6304992D016D76805F2FBD2B9421E2BF0DC78C2C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
static1/unpack001/Launcher.exe	SmartAssembly

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Launcher.exe

File Explorer

285_MW3-NET_Externa.rar

.rar 465KB
Launcher.exe

.exe 484KB
config.mw3esp

4KB

285_MW3-NET_Externa.rar

SHA256 6763ffd406b3cf3b6e9bd632ce1a33bf25fe1362a58c321ec6e01cd79390ab4b
MD5 d2d6d1fe8cd25121a2ce91b3891d3236
SHA1 6758df9546a639176b30ad9990fec63198c7300e
SHA512 2d6746e509037cd8e6425a1946f4ed1aa25eff245cb41a8c143b44a6efc536c3aa3c02ab4988ac07fc84726b01f4623a389b88b701f2931415ad0c517359d05f
SSDEEP 12288:oIJC1k2xBWoKmFZirA8s4AXyB9u2rEDf0lIvGC/Ev:oESkqBWut8sbirEDf0lI+CMv
TLSH
T15CA423570D2BF6DE087A6E1B3958B6304992D016D76805F2FBD2B9421E2BF0DC78C2C5
MD5 SHA1 SHA512 SSDEEP TLSH

Launcher.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 af68357756158fa65f2491706c9033b932168519f99590ead58e7b00474a7740
MD5 2330cea4171c2067d477f3ec70646423
SHA1 abc2b2e978010ae34bccd724493f22ff045cd559
SHA512 33cad54716e99a9315e43162155b70101ee12e5bed50a67a06a9ce9aa0b73ac181d74f52def75f60442051555a02b23f5bc0c6ce598458c41d68021f1282e8e9
SSDEEP 12288:SCSCyL2XWkg6Cqfd/HFKkaxGsvxvIxR/sVd:YpLTkAwPF8jvxCR0Vd
TLSH
T1C0B4226826D85E73EDBD043EE8B6531607B1C94AC8AAD74E14CCA379C437BDB090994F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

SmartAssembly .NET packer

Detects SmartAssembly .NET packer.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

501222

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

285_MW3-NET_Externa.rar

Launcher.exe

mscoree

dotnet

config.mw3esp

Sharing

General

Malware Config

Signatures

File Explorer

285_MW3-NET_Externa.rar

Launcher.exe

mscoree

dotnet

config.mw3esp