Behavioral task
behavioral1
Sample
XClient.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
XClient.exe
Resource
win10v2004-20230703-en
General
-
Target
XClient.bin
-
Size
34KB
-
MD5
c31f51296636f3cf612667c46083fe21
-
SHA1
2f9399f9aaa008bda6838541502f2df9d5ab28b2
-
SHA256
c4e3194545438baf94caf41506ea7b0f52be6bc00959f5ffb1c82ab701f5b09f
-
SHA512
45c9c87a87e50e099ebbee15c5f19c48c1c785eee107f709784ed40d96c34aade7b51aba89b19717ec0879dd3457a02c2f6e93ea2393aa6da0e7d1913a081f13
-
SSDEEP
768:gFbQ8NfWWAqE/rdTG9gfbHMlFyD9P7POjhZN3fAj:ZaWf/jVlbIFk9P7POj+j
Malware Config
Extracted
xworm
0XKZpBoUo8kfgVev
-
install_file
USB.exe
Signatures
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource XClient.bin
Files
-
XClient.bin.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ