Behavioral task
behavioral1
Sample
XmHelper.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
XmHelper.exe
Resource
win10v2004-20221111-en
General
-
Target
7a70ae6f43555d18608afce44cf60a939876628157753fbc4d634ccde79f6d03
-
Size
1.4MB
-
MD5
1e661ce58b8bc5f5e52299e37072af39
-
SHA1
f40bef33457b897142cd9952e93ff74d75e4de4b
-
SHA256
7a70ae6f43555d18608afce44cf60a939876628157753fbc4d634ccde79f6d03
-
SHA512
fe8731bbccbf26602fef40ce810e96106d13ed2efefdecfeae903816100ac532135ffd4ec72a48252ba1d308a97ddf03622b4a2278d23231488be7a74e351567
-
SSDEEP
24576://yzBX9bRaCnU1ariWRUSAbSpxxEHOguOMBD9CPJ8LMkBXxxqQABcEHDKK:SzB9w1opzA6SDuOMleJQNXxxqQYcEjKK
Malware Config
Signatures
-
resource yara_rule static1/unpack001/XmHelper.exe upx
Files
-
7a70ae6f43555d18608afce44cf60a939876628157753fbc4d634ccde79f6d03.zip
-
XmHelper.exe.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 128KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 49KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 34KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 59KB - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
˵.htm.html .js