Static task
static1
Behavioral task
behavioral1
Sample
X-Scan-v3.3/CheckHost.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
X-Scan-v3.3/CheckHost.exe
Resource
win10v2004-20231222-en
General
-
Target
0334583923c097da728485eb684ffdbc
-
Size
1.4MB
-
MD5
0334583923c097da728485eb684ffdbc
-
SHA1
3fcc5eff78183d84bb148564db363cd62b3c7866
-
SHA256
56bb19c769337281520171d2cc54a3cd81c524492c01e939852747975ee8260a
-
SHA512
0a363080ea9da4c7ff715e0f86ea591b8e2b1a49de238ef25780f137558613bed1d4ea9dcdd8916b45598a3c824fb4e6a8711772f1a8a4ca5109cc06ee3dfed3
-
SSDEEP
24576:eFKWMT8mImhYdnJx9bahMUOqXwgOdWrUnNiODi2pcUHnDWFCx1Nu:eFPMT88YdJXGtOqXmd0UQOVuf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/X-Scan-v3.3/CheckHost.dat
Files
-
0334583923c097da728485eb684ffdbc.rar
-
X-Scan-v3.3/CheckHost.dat.exe windows:4 windows x86 arch:x86
4b198eaebc71578e29297b06b472af95
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
Sleep
GetTickCount
GetPrivateProfileStringA
FreeLibrary
GetProcAddress
LoadLibraryA
TerminateThread
GetExitCodeThread
ResumeThread
SuspendThread
CloseHandle
OpenMutexA
CreateThread
GetLastError
CreateFileMappingA
CreateFileA
UnmapViewOfFile
MapViewOfFile
GetVersionExA
GetModuleFileNameA
LCMapStringA
SetEndOfFile
GetOEMCP
GetACP
GetCPInfo
ReadFile
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
SetStdHandle
SetFilePointer
FlushFileBuffers
WriteFile
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
LCMapStringW
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetModuleHandleA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetVersion
GetCommandLineA
ExitProcess
TerminateProcess
GetCurrentProcess
RtlUnwind
HeapAlloc
HeapFree
HeapReAlloc
ws2_32
WSACleanup
WSAStartup
htons
getservbyport
Sections
.text Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
X-Scan-v3.3/dat/AddressBook.ini
-
X-Scan-v3.3/dat/common_pass.dic
-
X-Scan-v3.3/dat/common_pass_mini.dic
-
X-Scan-v3.3/dat/common_user.dic
-
X-Scan-v3.3/dat/cvs_user.dic
-
X-Scan-v3.3/dat/default.cfg
-
X-Scan-v3.3/dat/ftp_user.dic
-
X-Scan-v3.3/dat/iis_code.ini