xworm | XClient[.]exe | Triage

Sharing

General

Target

XClient.exe
Size

81KB
MD5

bed19d044f6b3299cb37b86e04816690
SHA1

a4fa0c7ce7b16711ff567680909cc50f78255aba
SHA256

20806f50e4954a42390a992e0b7cc9a85cdbd41c6744cbb17abce03302e67041
SHA512

7cdb200105c55c9697a70098b09cb07708983f17572d6adf4d7ecd9258e148d5e24036066295f4afb78c87ca348e9c16fdd69a61666cc7258548f9474ecdfb67
SSDEEP

1536:YjkCdoWWLRIXB+7KSEzgaitPTwSNnsrxbgv/HNEZvrd68iQ3nOr9u:Y6WF5C+SSrxb6/srZbOrc

Score

10^/10

xworm

Malware Config

Signatures

Xworm family
xworm

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
XClient.exe

Files

XClient.exe
.exe windows x86

Password: frfrfrfrf

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ