XClient[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

XClient.exe
Size

95KB
MD5

7381161a5cb5e2081eaa5e6308b3d2a8
SHA1

258a20ec23c1e41ddbd3674890ba12fe1f91084f
SHA256

884fbda6f4c4a01715ea4047d437c5aa1602b71bb7fcbbfcd490c727d8fff21b
SHA512

5084d54d94b55c0cc6d52f8378ddb5402357c8c2e16c4e1fc3592388373779bd2dafbd2061e860f686a098c0aff9ce0e13c67fcff4df5adbc39d14d141fce50c
SSDEEP

1536:llY7euu7PSEae9cTDd5G4T6bzGKqvmJc61hg21OppcX9wKb264fUX8u:0B9ER+PGxbzrgc1OQtV2hcX8u

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
XClient.exe

Files

XClient.exe
.exe windows:4 windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 83KB - Virtual size: 83KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ