XClient[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

XClient.exe
Size

82KB
MD5

11b7cafd99778da46ea89ded38975b1e
SHA1

266819a607778d27ced2868f8da0e946749e12eb
SHA256

310ac7822fb7ac308cf1a9aed0eb42559f8987b4e1272580c762279d44a66abc
SHA512

6b89b63ff53eca6de7b7f022c6e5f0ba3a8d6b3396cdaaa3e832d64ffdb9f078a39f821425a750621136138995141e7ce43b48e2aa6a4a4cc203fc2ea9a7ce21
SSDEEP

1536:MWUZ+Cm8zLNWAXe5qsVOTN6+brHgQC6YE6QsLOnqTX59PHlV64fUX8u:PbCm2coekWec+brrZqOnGpJzhcX8u

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
XClient.exe

Files

XClient.exe
.exe windows:4 windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ