xworm | XClient[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

XClient.exe
Size

71KB
MD5

b458eef942e3052a6643545a7d42a209
SHA1

13aef24f5620499319be64c0e79ae21b8caab11c
SHA256

9215ead70b55932e664f13bd6537c6d66893777e030f64bb9f4b1d746caced0b
SHA512

61a89ec26d17edc1b9bb11a5777606fa54b34d886e6b15c3cf7ee6588070014742ac38c5f0b5ddb33649826cd8377167f6da0dfffc5b407ded7b0c0bc145c823
SSDEEP

1536:1xVKcjw9+J4Odhl2xipEtJbPJrORtAazaTgVO0o5Zq97:1dsAJ4lxip2bx3az4YO0o5k7

Score

10^/10

xworm

Malware Config

Signatures

Xworm family
xworm

Files

XClient.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ