XClient[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

XClient.exe
Size

51KB
MD5

4ac270bd1a93f2fec0e22efa4f6f13e4
SHA1

d1060eed8b9cd228fbb30dda52bf6dd6ffa2536f
SHA256

addcb5ace1061a7b2eda6c7dd3b8ab97b9223653b6769ae341558cf1a7af217b
SHA512

4ee0b17c26ce4d23548dd9e24f86470607d2558fa2d3a8c5fc057092e2dff2520e4b9bc58e890b5730ba66ec194d6c730d8ed53dd1a7eb38470cc9fd7c5b0a38
SSDEEP

1536:nYxjSX6kvCIyPcyL7xEo+Zzb+vCuRFKFO3f8+Be:YxI6k3CL7yzb+eFO3f6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
XClient.exe

Files

XClient.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ