Behavioral task
behavioral1
Sample
bMvg.exe
Resource
win7-20230220-en
General
-
Target
bMvg.exe
-
Size
41KB
-
MD5
dc455e0fc8fb490a442f90d6809c4acf
-
SHA1
81a5f561e27f4b47d8f9cb75f652590d0b3084f9
-
SHA256
3f81d7b9fd754f15331a5ef322931b07154673d74160c3008b0af32909da996a
-
SHA512
e5bb9b5a56ec774c90fecd05953b093f872a0243082e656ef083a9982381c0973a0db66f3fced6cb38cc69b27b1de355f7f8a27112e1388d167641f9f2e7305e
-
SSDEEP
768:R8ROoJD+YzyzvL0TFe4qjmx7UlOUIIG0h/uRDsQhLODDoR/+t6+:R8ROEDbzyv0BeDjWAIUxNuRv1O3k/+f
Malware Config
Extracted
xworm
DzففZ2wp4RHcلي2I
-
install_file
USB.exe
-
pastebin_url
https://pastebin.com/raw/yppjG8bz
Signatures
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bMvg.exe
Files
-
bMvg.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ