Behavioral task
behavioral1
Sample
944029da-76d7-4da7-8d0e-767cf1f85ec6.exe
Resource
win10v2004-20240226-en
General
-
Target
944029da-76d7-4da7-8d0e-767cf1f85ec6.exe
-
Size
468KB
-
MD5
b7ad36b9a91d81cb3e911069f5303e85
-
SHA1
0b32c48e059e5f2c57162864ef61d80e408b0934
-
SHA256
85fada75b9d311360bd78122da7dc5fa5c46f57e4352df77d6501e089893b3e2
-
SHA512
1f0007a6d7668b040eb8b481318912c0c1a3df8aa9e750d44d44b5f860ce244e22f296d6beb77f2e1f415eec6b7de468f2574e2d53f185fb8a50c718ef12f15a
-
SSDEEP
3072:ZpQiMpwVW7dJRV40P8Yvimdqz2qZbrUM:nykSdF8QHsFb
Malware Config
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 944029da-76d7-4da7-8d0e-767cf1f85ec6.exe
Files
-
944029da-76d7-4da7-8d0e-767cf1f85ec6.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 101KB - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 366KB - Virtual size: 366KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ