General
-
Target
test.exe
-
Size
68KB
-
MD5
aed484345e806fc48afa8c61d1a9b33a
-
SHA1
105d26a955b328bb54a5ddb86d77e5804d24e222
-
SHA256
8519befccb3543cf6fcb3ac2bd70b2aa5e44991b15b362bbfda0f07625582269
-
SHA512
8fc5885d0d2a4a8076b80d24bc1a91106e5414fa7db2c2b926bd91f3a430d3d30412855a614cd07de810269d1c272e5337243412680ee5c556a929cf68f46671
-
SSDEEP
1536:CeG6kcCconfTkFbLRnbN7JvLsQOBSxY6MOS4l9b8Hu:Ce1OnfkbpbN9wpOSOS4foHu
Malware Config
Extracted
xworm
0.tcp.ap.ngrok.io:7235
-
Install_directory
%AppData%
-
install_file
svchost.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource test.exe
Files
-
test.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 65KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ