General
-
Target
34343.rar
-
Size
61KB
-
MD5
47ef7340495466f124d5f48aea6b2d5e
-
SHA1
57477f4bb3b0e364705dcd2b9b52a16bedb83226
-
SHA256
7f93aaedcf0185373266c8c4e710eef2716641ebb241d68c80f33e525c448e5c
-
SHA512
f130306b9152546e6307594d2b0087433aca898b0925714e8911ce45d94e94fda44d9426bce2790fa91e57058e7fce0b79d4d09690a9cf50c7aa32450ff5e1d6
-
SSDEEP
1536:iljxJUgBdbm6E12bDZ4L5vA/XrZMqxniCTMfysMHE/v:0DUgn7xt/XrZnniCwftf/v
Malware Config
Extracted
xworm
3.1
dffsdfsdfe434334.bounceme.net:7000
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule static1/unpack001/34343.exe family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/34343.exe
Files
-
34343.rar.rar
-
34343.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 114KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ