Behavioral task
behavioral1
Sample
fa5a74ef1355ddd1d5984b84d52d7aa0727e11e40a89ca3a2bbf4594eea57730.exe
Resource
win10-20231020-en
General
-
Target
fa5a74ef1355ddd1d5984b84d52d7aa0727e11e40a89ca3a2bbf4594eea57730
-
Size
158KB
-
MD5
1ade097499dd5fb334ffe69d06d00b31
-
SHA1
ab5e0d3a2e0a71b2afe9a04bd24835a8f5874079
-
SHA256
fa5a74ef1355ddd1d5984b84d52d7aa0727e11e40a89ca3a2bbf4594eea57730
-
SHA512
b35aec83bbf5e0501a706df42db4db1b077acf88e37a4d6c65b52c83f24db0e0eb33fad9f22f0a847a14f6540419d85e24062f9c65a2a6d96db5ab20d315598e
-
SSDEEP
3072:6vpWpop9+bNFwwO52HJe5BV0bUniyimyx:IVpkbEaJe5v0bURy
Malware Config
Extracted
xworm
topics-junior.at.ply.gg:45283
-
Install_directory
%AppData%
-
install_file
msedge.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fa5a74ef1355ddd1d5984b84d52d7aa0727e11e40a89ca3a2bbf4594eea57730
Files
-
fa5a74ef1355ddd1d5984b84d52d7aa0727e11e40a89ca3a2bbf4594eea57730.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 85KB - Virtual size: 84KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 72KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ