Behavioral task
behavioral1
Sample
2724540x00000000000900000x000000000009E000memory_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2724540x00000000000900000x000000000009E000memory_JC.exe
Resource
win10v2004-20230831-en
General
-
Target
2724540x00000000000900000x000000000009E000memory_JC.dmp
-
Size
56KB
-
MD5
9c124df4c253eecc0c2de5236f3cf8b2
-
SHA1
e44ed241b1a131603e11835669e0b17a4e6ef7a6
-
SHA256
d1b595ce5a4004135c64b50220466a5840e5877081f7fdf611d310c4ca8cb109
-
SHA512
c12f2ce93c41040d1489bb17f8a7394efa212d375b0bf9111d7d4e53ffe9b0bc4dde434d61d64d334c60d738cc037f00f23925c8488e371706b0843f08468641
-
SSDEEP
1536:8DGkptwyZScCkU4rAUsZcB5xCuF59CpO9J:GkUs6VF59CpO9
Malware Config
Signatures
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2724540x00000000000900000x000000000009E000memory_JC.dmp
Files
-
2724540x00000000000900000x000000000009E000memory_JC.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ