Behavioral task
behavioral1
Sample
Expensive2.0 crack.exe
Resource
win11-20240508-en
General
-
Target
Expensive2.0 crack.exe
-
Size
79KB
-
MD5
863711c10c1844754fca2729ac0f0380
-
SHA1
2836a5baebb141188c2f845453a2c7700ed6e40f
-
SHA256
a441decf9cc4b9ac966e45c4127f253818f75328a30f2810acacf6551cd6f2bd
-
SHA512
6aa41e7112b5edbc9e3a1d7ab5fb5fb5e26c5cde702f60f70715178a7acb59479f59d182afe5c42ba0b5ca6f5107934b47c19ecd6e99c34fbc7386804c2aa7d6
-
SSDEEP
1536:YA2ixxSE7SX6TkIjnG18PyC+uF8iqUH3pbLYkDlGe4QDDa2OYoFpUrps24u:LgIu8PlxpbLYslNODF1u
Malware Config
Extracted
xworm
-
Install_directory
%AppData%
-
install_file
USB.exe
-
pastebin_url
https://pastebin.com/raw/cVQrB6DR
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Expensive2.0 crack.exe
Files
-
Expensive2.0 crack.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ