Behavioral task
behavioral1
Sample
XD spoofer 2.exe
Resource
win10-20240221-en
General
-
Target
XD spoofer 2.exe
-
Size
301KB
-
MD5
12aa7e5d2417b27a76f622f3932d28ab
-
SHA1
3392c82e43ce556e952c9dd2aeaa724bb71ac28f
-
SHA256
82e8978405208afa5ff71b4d038f21aa8d82369a2361a8b2ef5f50756488d295
-
SHA512
d10c3ea5c37bf9b2bcb70635bafd0638905ca038d2e971bc8adc2d37ac0be6ed436cb7712b2d697d03cd1cb97aaa4412d331407bcef8c287fe62a95406de43c7
-
SSDEEP
3072:CC6K8EQZlhObHDIPiULMWM9iQkyQ6OquEfZJmMq0utJFU9r21BYb/xH9coCQXOQ2:C7jORitJcOMuQAPg1eLxexu9bpt6DQ
Malware Config
Extracted
xworm
5.0
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource XD spoofer 2.exe
Files
-
XD spoofer 2.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 294KB - Virtual size: 294KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ