General
-
Target
willitconnect.exe
-
Size
54KB
-
MD5
f11cc37f7d2c48a8067e8ead6022e086
-
SHA1
dc5a0f45ccab1bcde0c80302a2e7249795f750ec
-
SHA256
4fb7670cba8b18af31a799186e456d78b34db5982e96b9a9be538346025d96b8
-
SHA512
601e82f96b4a0ee31d8684c7f6fc6f493210e8024b076a1c19d34b19ab52f605db126ef99fd826f5c1e74f02c5c646925e414808392ac3850c6d24dec81ffb0b
-
SSDEEP
1536:vljkaa4Bpv/R/jR7akbUkGplSqx3v66iGquOOWHuM:q4bZ17akbUkGz4GPOHOM
Malware Config
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource willitconnect.exe
Files
-
willitconnect.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 52KB - Virtual size: 51KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ