General
-
Target
svchost.exe
-
Size
44KB
-
MD5
e016d998cc83a07d7f527e2f2663c203
-
SHA1
ab620f5013ff3e035cd9adfbbd0fa39e6fe8e28c
-
SHA256
479d3fbea1ab6818d3ddf15d99d97b156f201c0854a2105e6c67310da172ac52
-
SHA512
914c3898c90b96812de904b923d27c6b70693b04ff6f09b74dcd7ddf846516927346c129b0b6503cb7867238c796f8ca4ec203e9bafb4ebba75019c769722047
-
SSDEEP
768:m3dZKcQ8A5MJqM+czV8+PR7hOP2qU3PQhLOSwo8/69j:EstkquzVfvO281O88/69j
Malware Config
Extracted
xworm
license-donna.at.ply.gg:55049
vPxQcY5x2JutoRz0
-
install_file
USB.exe
Signatures
-
Xworm family
Files
-
svchost.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 42KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ