General
-
Target
dwdadwdwdwd.exe
-
Size
44KB
-
MD5
4f62cc442abeafa28e7c3f739c57af96
-
SHA1
65241b97f9a3b4611029c96988e984db150a0736
-
SHA256
2df6920ecb9cc4ed33fcb4ed91e6feb75b2697f4036feea862e461612a3fe642
-
SHA512
864d643935a31aca70f59d51ecb21ed7bb314bc6e48840aa45ff1ac5a630b288313288614f8c552e5a60f04f71a6d9808383e216bfcf476ac45929c9a8bf161c
-
SSDEEP
768:xtAbfFuROha3LPKe98D+07eEsRgkbfVFNh4BZOhhHap8pI:ncuoUSes8+kbfVZ4rOhFQ8I
Malware Config
Extracted
xworm
192.168.0.7:5004:5004
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dwdadwdwdwd.exe
Files
-
dwdadwdwdwd.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ