XIDRF[.]exe | Triage

Sharing

General

Target

XIDRF.exe
Size

40.2MB
MD5

e8e93e4c8396aa3792f020f10f67f9fc
SHA1

25349054267945301cdd8816290e2f7022c927eb
SHA256

294e27afe4e0d79c7fa2d94699b95a54dbc4176603083ad5f0fff6a0c1f698d8
SHA512

efabc20676a88c3a02ea66b99c68949d81584f70f06602f48de62ceb2a325d3bf40ada69f46a0d764c40123763f095a7745f819a016d6a3f47e9f755728339fa
SSDEEP

786432:C+FZZ4/nNYHNTmMRdY18jqynymTRI0ryBr+ri1Jnar2L+:r7AnN6pmMo18tC0ryBr+rivg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
XIDRF.exe

Files

XIDRF.exe
.exe windows:4 windows x86 arch:x86

a9c887a4f18a3fede2cc29ceea138ed3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msvcrt

malloc
memset
strcmp
strcpy
getenv
sprintf
fopen
fwrite
fclose
__argc
__argv
_environ
_XcptFilter
__set_app_type
_controlfp
__getmainargs
exit

shell32

ShellExecuteA

kernel32

SetUnhandledExceptionFilter

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40.1MB - Virtual size: 40.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ