Behavioral task
behavioral1
Sample
HEUR-Trojan.MSIL.Witch.exe
Resource
win7-20220901-en
General
-
Target
HEUR-Trojan.MSIL.Witch.gen-9d8507a5ce83a0584aaa7c349a1f04e54b0c0d15433c0e54c2c1b74078cd3b2c
-
Size
40KB
-
MD5
171e40f206b7543658fe0f26e03b9c65
-
SHA1
690892775cfb9254ec4ca0d4d8121d0728df0068
-
SHA256
9d8507a5ce83a0584aaa7c349a1f04e54b0c0d15433c0e54c2c1b74078cd3b2c
-
SHA512
8f8f971fd8dcc2b499afb92f5210bf85a1dd3d006721c189cf0c5c3d0fa2186d7ef084dda2876b2def33b9f56f13fd458825798c9412cd37f2f6735d6b8159e9
-
SSDEEP
768:V13So7suPUw1GmqwK1JUBkquxKdVC7+1RzdqS:VIruj1ygTCEbqS
Malware Config
Extracted
xworm
194.228.111.236:7000
wRWhbzj3MKqpmTKJ
-
install_file
USB.exe
Signatures
-
Xworm family
Files
-
HEUR-Trojan.MSIL.Witch.gen-9d8507a5ce83a0584aaa7c349a1f04e54b0c0d15433c0e54c2c1b74078cd3b2c.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ