General
-
Target
XClient.exe
-
Size
50KB
-
MD5
631ef5ed0a522dcbd9692a8d87bc199f
-
SHA1
961741cd8f8a3ac49b684d571073c22237b597fe
-
SHA256
082659d217f6d1d502bc6e3ddb5ad3d00a7d27372e79eb9e5baa9f666aff178c
-
SHA512
a62a34aacc8bb4fafc1548436f3ef0965538ce28c260c948c05e428715482add46542077836aad58d8cb2fa720390ec03d2db815c97c044cb0dd479302e91e27
-
SSDEEP
768:0FxHpnJciaILjXlSg3HpP+fFt3QZgzbRTjDYuv7HffMQ/OxChXd:0FH1ao08l+tt3tzbRTbHHMQ/OxCj
Malware Config
Extracted
xworm
WNIKO1-39869.portmap.host:39869
-
install_file
USB.exe
Signatures
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource XClient.exe
Files
-
XClient.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ