XClient1[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

XClient1.exe
Size

65KB
MD5

581317a22583d2619c167a448d03e422
SHA1

40ec0ab86a99544b5fd789e9955b1f72a8fd42ce
SHA256

69675e45376422a4aa06dfcaec4aa15d3420025453c768fa225b27ee5eb5a958
SHA512

0224fd93e2a77cfdbc6f00110f90ddf2a72690f215acbdea4585fef11db4cb4e9b1e53081b11dcfa2c7d8e18c5eb00d8a6ce88f1fa91ddc14c83bf4a56507b38
SSDEEP

768:vDn4+YhnBiGPUec8zR4wufBZxHi3j4bVQezbesKuZrxOMH76KNYJf9RO2Phu4ecn:E+Y/8Ma3C3j42obezudxf6dROMbzqbO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
XClient1.exe

Files

XClient1.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ