Behavioral task
behavioral1
Sample
Cheats.rar.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Cheats.rar.exe
Resource
win10v2004-20230703-en
General
-
Target
Cheats.rar.exe
-
Size
202KB
-
MD5
cd2a03beec114d67ab70e23af0cd7030
-
SHA1
bfa47668b551d1d54d3365c6bea6b3c51c8000be
-
SHA256
8568f322c2d13fc6948829e7be14f94f25900f50bf011e8e2da193002db31249
-
SHA512
a396ff187766768e97f630322bf6aa1aa9281b33b6d1ee3d08917b9fa5741007e8d5a9a3a049a83a73642a7305545489a181fc883b39743a25876987e9f33a4f
-
SSDEEP
6144:Yc+TSUcTJK9WUhcX7elbKTuq9bfF/H9d9n:Yc+Ta3X3uO
Malware Config
Extracted
xworm
0.tcp.eu.ngrok.io:14834
uzN0hTCOysPqikUj
-
install_file
USB.exe
Signatures
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Cheats.rar.exe
Files
-
Cheats.rar.exe.exe windows x86
Password: rar
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 166KB - Virtual size: 166KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ