xworm | funny funny[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

funny funny.exe
Size

121KB
MD5

8aa468e01b0ad67714e2f77166f7230f
SHA1

d4f7337c88a628459a61c7f6d98be20e72b6ef4f
SHA256

b42490c9c0f2045410c88ddc017d67267567ae3941c0e0b368a8aa9128cd94a7
SHA512

1c2643efff1aa0dca45e261119fe6665905b425daa079dc55fdc4c4db599ad1af7874d5e66f16e95ddd5bf7e3c30489cb61f4dac95e08d995b34e6f72508506d
SSDEEP

3072:EXOhMIBwld+PkbE6wu7gLOs4ZM8XfGmFwDD0osU:EeCh+sbyu7N7XZ+

Score

10^/10

xworm

Malware Config

Extracted

Family

xworm

C2

outside-wilson.gl.at.ply.gg:3991

Attributes

Install_directory
%AppData%
install_file
WindowsPowershell.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
sample	family_xworm

Xworm family
xworm

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
funny funny.exe

Files

funny funny.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ