xworm | Viruses[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

Viruses.zip
Size

262KB
MD5

46003b435f9d5e54228298974b0c9b14
SHA1

ba425c604e393b0375ea6de2bb215a5ce1419f51
SHA256

418be84b731bb80e3652b4aef6da76ed8ce226ae04c920d1bfcb4fd8fbf866d4
SHA512

c5e55b5190af49b8cb99c52a80f27c65f74cdd021e1eb9cd3ca64073231ebdb6b6142c860af7889e7722610bacb1ab13ba9e86d793e59271cb0100c442f41dad
SSDEEP

6144:Pr+y+KMnb/ACtpbKs8Y82YairdpMd1KLfqrqbg:PrOLnb/xNmTaigwqrqk

Score

10^/10

xworm

Malware Config

Extracted

Family

xworm

Version

5.0

127.0.0.1:1820

182.176.170.74:1820

Mutex

Gx1yTHIG7gZFF5ch

Attributes

Install_directory
%AppData%
install_file
XClient.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
static1/unpack001/virussign.com_3c1ae39c416d64729380aac114979c80.exe	family_xworm

Xworm family
xworm

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
unpack001/virussign.com_3084128dd081718b283ed6d53fb9fd80.exe
unpack001/virussign.com_3c1ae39c416d64729380aac114979c80.exe
unpack001/virussign.com_58eff4962d73639ebd30d48eb65fea80.exe
unpack001/virussign.com_6222406cfc74978b318aa925343a2100.exe
unpack001/virussign.com_6db12223208f29ce277889b73be78c40.exe
unpack001/virussign.com_7b4be063fcf580e7d833845547787dd0.exe

Files

Viruses.zip
.zip
virussign.com_3084128dd081718b283ed6d53fb9fd80.exe
.exe windows:4 windows x86 arch:x86

0abad43e831a4d83cef34fd47272b468

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RtlMoveMemory

msvbvm60

MethCallEngine
ord517
ord518
ord593
ord594
ord520
ord709
ord631
ord632
ord526
EVENT_SINK_AddRef
ord527
ord529
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
ord712
ord606
ord607
ord608
ord717
ProcCallEngine
ord644
ord537
ord648
ord570
ord573
ord685
ord100
ord616
ord617
ord618
ord619
ord580

Sections

.text
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
virussign.com_3c1ae39c416d64729380aac114979c80.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 265KB - Virtual size: 265KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
virussign.com_58eff4962d73639ebd30d48eb65fea80.exe
.exe windows:4 windows x86 arch:x86

98f67c550a7da65513e63ffd998f6b2e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

EVENT_SINK_GetIDsOfNames
__vbaStrI2
ord690
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarVargNofree
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaLateIdCall
__vbaPut3
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
__vbaPut4
EVENT_SINK_Invoke
__vbaRaiseEvent
__vbaFreeObjList
ord516
__vbaStrErrVarCopy
ord517
_adj_fprem1
__vbaRecAnsiToUni
ord519
__vbaCopyBytes
__vbaStrCat
__vbaLsetFixstr
__vbaRecDestruct
__vbaSetSystemError
ord661
__vbaHresultCheckObj
__vbaNameFile
_adj_fdiv_m32
__vbaAryVar
Zombie_GetTypeInfo
__vbaAryDestruct
ord669
ord593
__vbaBoolStr
__vbaExitProc
__vbaI4Abs
ord594
__vbaOnError
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaFpR4
ord705
__vbaStrFixstr
_CIsin
__vbaErase
ord631
ord709
ord525
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaGet3
__vbaStrCmp
ord529
__vbaGet4
__vbaPutOwner3
__vbaVarTstEq
__vbaAryConstruct2
__vbaObjVar
__vbaI2I4
DllFunctionCall
__vbaVarLateMemSt
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaLateIdCallLd
Zombie_GetTypeInfoCount
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaNew
ord600
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
ord712
__vbaStrToUnicode
ord606
_adj_fprem
_adj_fdivr_m64
ord714
ord716
ord609
__vbaFPException
ord717
ord319
__vbaGetOwner3
__vbaUbound
ord535
__vbaFileSeek
ord644
ord537
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVarLateMemCallLdRf
ord648
ord570
__vbaNew2
__vbaInStr
_adj_fdiv_m32i
ord572
_adj_fdivr_m32i
__vbaStrCopy
__vbaI4Str
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord578
ord100
__vbaVarSetVar
__vbaI4Var
ord689
__vbaLateMemCall
__vbaVarAdd
ord611
__vbaAryLock
ord320
__vbaStrComp
__vbaVarDup
__vbaStrToAnsi
ord321
__vbaFpI2
__vbaFpI4
__vbaVarLateMemCallLd
ord616
__vbaVarSetObjAddref
__vbaRecDestructAnsi
__vbaLateMemCallLd
_CIatan
__vbaAryCopy
__vbaStrMove
ord618
__vbaCastObj
__vbaR8IntI4
ord650
_allmul
__vbaVarLateMemCallSt
_CItan
ord546
__vbaAryUnlock
_CIexp
__vbaFreeObj
__vbaFreeStr
ord580
ord581

Sections

.text
Size: 172KB - Virtual size: 169KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
virussign.com_6222406cfc74978b318aa925343a2100.exe
.exe windows:5 windows x86 arch:x86

fa4d86a4e89ae79ea2a222aeb8f63583

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

rundll32.pdb

Imports

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_wcmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
_except_handler3
_wtoi
_vsnwprintf

kernel32

GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetErrorMode
DeactivateActCtx
GetCurrentProcessId
GetFileAttributesW
SearchPathW
CreateActCtxW
ActivateActCtx
LoadLibraryW
ReleaseActCtx
LocalAlloc
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
CloseHandle
SetFilePointer
ReadFile
CreateFileW
WaitForSingleObject
CreateProcessW
Wow64EnableWow64FsRedirection
lstrcpynW
GetSystemDirectoryW
GetNativeSystemInfo
IsWow64Process
GetCurrentProcess
GetCommandLineW
FreeLibrary
LocalFree
lstrlenA
WideCharToMultiByte
GetLastError
lstrlenW
GetProcAddress
FormatMessageW
GetSystemTimeAsFileTime

gdi32

GetStockObject

user32

CharNextW
SetClassLongW
LoadIconW
DefWindowProcW
CreateWindowExW
RegisterClassW
LoadCursorW
DestroyWindow
MessageBoxW
LoadStringW

imagehlp

ImageDirectoryEntryToData

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 884B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 52KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
virussign.com_6db12223208f29ce277889b73be78c40.exe
.exe windows:5 windows x86 arch:x86

3bd1cf97537104404441a903e61f0f5f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

HttpSendRequestW
InternetSetOptionW
InternetQueryOptionW
HttpOpenRequestA
HttpQueryInfoW
InternetReadFile
InternetConnectA
InternetOpenW

kernel32

lstrlenW
WriteFile
GetCurrentDirectoryW
HeapFree
FreeLibrary
GetProcAddress
LoadLibraryW
DeleteFileW
GetModuleHandleW
HeapCreate
HeapAlloc
GetModuleFileNameW
GetTempPathW
CreateFileW
GetFileSize
lstrcmpW
ExitProcess
ReadFile
CloseHandle

user32

wsprintfW

shell32

ShellExecuteW

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 8B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 206B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
virussign.com_7b4be063fcf580e7d833845547787dd0.exe
.exe windows:4 windows x86 arch:x86

850bf254c76e5c8effedc1f08eb6c411

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

user32

GetClassNameA

Sections

.MPRESS1
Size: 90KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Extracted

Signatures

Files

0abad43e831a4d83cef34fd47272b468

Headers

File Characteristics

Imports

kernel32

msvbvm60

Sections

.text Size: 49KB - Virtual size: 49KB

.data Size: - Virtual size: 9KB

.rsrc Size: 2KB - Virtual size: 2KB

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 42KB - Virtual size: 42KB

.rsrc Size: 265KB - Virtual size: 265KB

.reloc Size: 512B - Virtual size: 12B

98f67c550a7da65513e63ffd998f6b2e

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 172KB - Virtual size: 169KB

.data Size: 4KB - Virtual size: 6KB

.rsrc Size: 4KB - Virtual size: 1KB

fa4d86a4e89ae79ea2a222aeb8f63583

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

gdi32

user32

imagehlp

Sections

.text Size: 6KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 884B

.rsrc Size: 52KB - Virtual size: 53KB

3bd1cf97537104404441a903e61f0f5f

Headers

DLL Characteristics

File Characteristics

Imports

wininet

kernel32

user32

shell32

Sections

.text Size: 1KB - Virtual size: 1KB

.bss Size: - Virtual size: 8B

.rdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 448B

.reloc Size: 512B - Virtual size: 206B

850bf254c76e5c8effedc1f08eb6c411

Headers

File Characteristics

Imports

kernel32

user32

Sections

.MPRESS1 Size: 90KB - Virtual size: 128KB

.MPRESS2 Size: 3KB - Virtual size: 3KB

.rsrc Size: 2KB - Virtual size: 1KB

.text
Size: 49KB - Virtual size: 49KB

.data
Size: - Virtual size: 9KB

.rsrc
Size: 2KB - Virtual size: 2KB

.text
Size: 42KB - Virtual size: 42KB

.rsrc
Size: 265KB - Virtual size: 265KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 172KB - Virtual size: 169KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 4KB - Virtual size: 1KB

.text
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 884B

.rsrc
Size: 52KB - Virtual size: 53KB

.text
Size: 1KB - Virtual size: 1KB

.bss
Size: - Virtual size: 8B

.rdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 448B

.reloc
Size: 512B - Virtual size: 206B

.MPRESS1
Size: 90KB - Virtual size: 128KB

.MPRESS2
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 2KB - Virtual size: 1KB