Behavioral task
behavioral1
Sample
XWorm Ping Optimizer.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
XWorm Ping Optimizer.exe
Resource
win10v2004-20230915-en
General
-
Target
XWorm Ping Optimizer.exe
-
Size
209KB
-
MD5
43bb693a4d3ca23a85015b487f0db69a
-
SHA1
4a29501c02988e111c2c6c9dccdbd135c119a4e8
-
SHA256
f645030d125dac92a38f919cc0b134f7cba5f70f0fc5ce421a532dfe1515c22e
-
SHA512
3694b42ef2f8ad357df9934349c100a0fd6a8386c7859ee1299bc34ba200429ac9584695a174050c425c91f120d9f40091773963e9a3427c323f614a36b7ca13
-
SSDEEP
3072:ugUv1gB5CLa9bqqsBoO/Ya1W7T4MxK08cnNizrQxs/DrGQG3v9RfPJ:uJ1I5CLqbYlIT4MxKJzrAP
Malware Config
Extracted
xworm
functions-screensavers.gl.at.ply.gg:11035
-
Install_directory
%Temp%
-
install_file
XWorm Auto Updater.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource XWorm Ping Optimizer.exe
Files
-
XWorm Ping Optimizer.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 72KB - Virtual size: 71KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 136KB - Virtual size: 135KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ