Behavioral task
behavioral1
Sample
XClient.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
XClient.exe
Resource
win10v2004-20230703-en
General
-
Target
XClient.exe
-
Size
61KB
-
MD5
654a9a23f94cdcfe31cdd98cd7e9dd1f
-
SHA1
3e7fab38617cce17abc79b5c87fbdd9597940cda
-
SHA256
c54430b097c3220bf89dceac9e0e4ecfa6ab95302b30830e0c4f0aa64d617267
-
SHA512
e75b67e6b907c58a5f55a308618ba7311114da347c0d48ff8a7304986348115d917d654e65a81903ef82d005ee548e43e35b74b78c3de54fe7e17d32ac20a87c
-
SSDEEP
1536:cfBPd1ylaxTobN2bN4R1DL66Z/TpYOR/P3:cf1ylsYgbNwlVT+ORn3
Malware Config
Extracted
xworm
WNIKO1-39869.portmap.host:39869
-
install_file
USB.exe
Signatures
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource XClient.exe
Files
-
XClient.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 59KB - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ