Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
General
-
Target
tmp
-
Size
35KB
-
MD5
aa1ad291d5d8c8a85d67fdebda00274f
-
SHA1
d95247076cb691c52473fabcce13dcc481ae11aa
-
SHA256
9668fa123ac5d63243a973a70418c32c6405b636d54c8705d6656c3be4969ae5
-
SHA512
c00c191f50ce72128d71ee28d06f8800c590e03b0cfde5f8c0c46af6edf51c54bc85cc6bb128f4ce5ff0ae9e533628eabe587e52cd5c1aae12a96ac422d86da4
-
SSDEEP
384:81ThpqXsIUe603z2hp0JIwkLO41KKuDXzBXslXVf+gtF1BLTiZw/WNnvK9IIku8M:8i2hp0KfObKeYXV/F39efOO9hI3vxME
Malware Config
Extracted
xworm
20.56.93.201:1604
LsHrpmVtuRP6SOPB
-
install_file
USB.exe
Signatures
-
Xworm family
Files
-
tmp.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 33KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ