Behavioral task
behavioral1
Sample
HEUR-Trojan.MSIL.Witch.exe
Resource
win7-20220812-en
General
-
Target
HEUR-Trojan.MSIL.Witch.gen-b88cc87476c96511d4da70732e1928471f9d48d25b2c7cc573ad2b2cdf19d3b0
-
Size
43KB
-
MD5
8dd552306dfea0bf3895bf8f80b9128a
-
SHA1
046aa632f7580edc777c1ba6a0aced4ca7245b26
-
SHA256
b88cc87476c96511d4da70732e1928471f9d48d25b2c7cc573ad2b2cdf19d3b0
-
SHA512
5233a581f7c02762678d119e9a725a313642e56c8dbb7d5089e254c35272ef6f5973758e6e27ac238897ed818da992a494835092a3cfdf040dfef35b659de767
-
SSDEEP
768:yn/iPHWz9UsOVJe3Lm5QsrI5bP+UGdQkxwyjlO9UWNQdjh1:y/iPoUVJeSSsE5bizxdQRMjh1
Malware Config
Extracted
xworm
199.66.93.150:1337
90pm4dET9bGOmmnh
-
install_file
USB.exe
Signatures
-
Xworm family
Files
-
HEUR-Trojan.MSIL.Witch.gen-b88cc87476c96511d4da70732e1928471f9d48d25b2c7cc573ad2b2cdf19d3b0.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ