xworm | 8ee82ed071d8064330501e3f5357ecf5cddc63cfe5919020e524e4caf7a38ccd[.]zip

General

Target

8ee82ed071d8064330501e3f5357ecf5cddc63cfe5919020e524e4caf7a38ccd.zip
Size

15KB
MD5

013e5f214c237a1747b4aa7ca65644d3
SHA1

d6caa787a1a022d695ae5debedac9233eaada2df
SHA256

2c4ba7914783143681fce8986d7d2443c8731caf5636a5861854a99b9473b6c7
SHA512

8210141eb8b0a4f4c6a4b3b5260db40a2027366e51f35f404a51fccaf5790b39b2bd1fb9f87d817af31595ecf8b6219a5122ffcd00b992f3564e55a5064f8311
SSDEEP

384:mhmwqUq7DBg/1gVmxg/ov/bn6RVBdjmowHNIE9iVB7FmNPcjTaG:XDUKW1gV0gArn6rLSowHNIlRmK6G

Score

10^/10

xworm

Family

xworm

Version

5.0

C2

81.230.10.189:30120

Mutex

Dvg8qiquSohMZia9

Attributes

aes.plain

Detect Xworm Payload 1 IoCs

resource	yara_rule
static1/unpack001/8ee82ed071d8064330501e3f5357ecf5cddc63cfe5919020e524e4caf7a38ccd	family_xworm

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/8ee82ed071d8064330501e3f5357ecf5cddc63cfe5919020e524e4caf7a38ccd

8ee82ed071d8064330501e3f5357ecf5cddc63cfe5919020e524e4caf7a38ccd.zip
.zip

Password: infected
8ee82ed071d8064330501e3f5357ecf5cddc63cfe5919020e524e4caf7a38ccd
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ