Behavioral task
behavioral1
Sample
MICROSOFT77NM.exe
Resource
win7-20240221-en
General
-
Target
MICROSOFT77NM.exe
-
Size
269KB
-
MD5
ff26606c3dbb5242a4469dc4979ddbd9
-
SHA1
6140b2257f63c40a761e92f3f387e42080eb98a3
-
SHA256
bac3a7cda8c0c0fcad6cfbada765077691136f6c56dfdb61cd733e8f0727c752
-
SHA512
35db138d24cf57eeccc42ffb5b6c1a1cd95400085ce51f16ad2b4690ef581b17208b3fe818ed29020ba671e228e27c699c0d51fa4dec4fb9bf300b03d3dd369f
-
SSDEEP
6144:/Ol9IguKV5BwUnZqazMhD9RLJt88sndcP8pPyDvUGOksEb:/zKLBwiZlzMB9xgndcP88DvvP
Malware Config
Extracted
xworm
3.1
-
install_file
game.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource MICROSOFT77NM.exe
Files
-
MICROSOFT77NM.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 267KB - Virtual size: 266KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ