Behavioral task
behavioral1
Sample
270480x00000000004000000x0000000000418000memorydmp.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
270480x00000000004000000x0000000000418000memorydmp.exe
Resource
win10v2004-20231215-en
General
-
Target
270480x00000000004000000x0000000000418000memorydmp.exe
-
Size
96KB
-
MD5
ac5e2afa8e7ffeeb15d6de619ffa9711
-
SHA1
709882c9a8dec9c021177677d7fc9da6cdc0a9d0
-
SHA256
cc5ca5fcd48f294abc7d2ed45bea24a60d3610035545ba3e0d5b0e59d96bf4a3
-
SHA512
e2a8d4daf4ad0fafe4fd1e99bab527c679798977e79a5d79feb4d61e02fcb490fd409924f71280309b08aef7c168414cb1a77e26aa1fdd4739c1b50c026daa54
-
SSDEEP
1536:PJA52/Ww6DHfhetrXvHp0t/y1WxBw+bAV5rvME9g6VLb+HOe3vsG:qPpyrfHpuySBw+bAXME9bUOefd
Malware Config
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 270480x00000000004000000x0000000000418000memorydmp.exe
Files
-
270480x00000000004000000x0000000000418000memorydmp.exe.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 66KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ