Static task
static1
Behavioral task
behavioral1
Sample
XClient (3).exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
XClient (3).exe
Resource
win10v2004-20230703-en
Errors
General
-
Target
XClient (3).bin.zip
-
Size
42KB
-
MD5
71d2f6167b4ef7be7c378741601584d2
-
SHA1
1fa9ba32702cf62d506a9c2b7d2c5bbf66aca205
-
SHA256
e3c4bbba1700171565973fc03dd88cc8a26b132a021cf44cce2c5390831441ea
-
SHA512
57c99ef5574a0a053202e570075ffb9bf52ae6ae6b8243afdf86950a05f7c10c1095a0a716088059d5eabc8987f10ac90b69c0b71bc4801a125f3c9e8e97481a
-
SSDEEP
768:KhNjqd+FG8jlo5Xgui6cIcn26iWZxFDCDv+jFSgBPKAaKdMURd:KhNjqdN8jG5XPdcIcnnvZxJ0v+p9pGUf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/XClient (3).bin
Files
-
XClient (3).bin.zip.zip
Password: infected
-
XClient (3).bin.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 72KB - Virtual size: 71KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ