xworm | f1752377fdbc7e2fa65dd744499690174fb3eebc7ffab32598a257b762991937[.]exe[.]zip

General

Target

f1752377fdbc7e2fa65dd744499690174fb3eebc7ffab32598a257b762991937.exe.zip
Size

21KB
MD5

3ba3bddaa49ff7ba79553c3f808d96dd
SHA1

f29b44915a23543102228b62717a32f0aedab691
SHA256

5a6e793271336c0b492d2a65965afca05832da46a62b09149255c23a4d215581
SHA512

f59d9956626714ef3a4af1296fe15eb52a9caa0360d88cf6950c6799235b4e15f3bcb52030a85e89183c0f3a8e48e7b46a4775432b51a2e7bbd178c673cf7b63
SSDEEP

384:Wbn5upZGtColEX6aKlnZ5uSRogGS4lUkAGIvlO0hxIylze5/scR5dYP78dZ0X:c5UclEX8gSAUkAGItf/L+kPIdyX

Score

10^/10

xworm

Family

xworm

Version

2.2

C2

pool-roman.at.ply.gg:25972

Mutex

e7QU1ftEFxs2xQLk

Attributes

aes.plain

Detect Xworm Payload 1 IoCs

resource	yara_rule
static1/unpack001/f1752377fdbc7e2fa65dd744499690174fb3eebc7ffab32598a257b762991937.exe	family_xworm

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/f1752377fdbc7e2fa65dd744499690174fb3eebc7ffab32598a257b762991937.exe

f1752377fdbc7e2fa65dd744499690174fb3eebc7ffab32598a257b762991937.exe.zip
.zip

Password: infected
f1752377fdbc7e2fa65dd744499690174fb3eebc7ffab32598a257b762991937.exe
.exe windows:4 windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ