Behavioral task
behavioral1
Sample
VOID.exe
Resource
win7-20240611-en
General
-
Target
VOID.exe
-
Size
133KB
-
MD5
60a8999608ad4b1a80083eff222e755f
-
SHA1
5df27c9660ee0e5ae6ad031dc9e16b2ea69d6782
-
SHA256
baca7710ced3fdc26d2f0d33c4316dfda772fadb55c3f66ca738014f69e40922
-
SHA512
65bd2cab38c57d94988345f1aaa71be7abbb8a99aaddb8b64e0dc847871ac1ed3fb7520ed3f2a790b494fb66f52d774f15e03a5bcb9131f4840cbec685af8814
-
SSDEEP
768:l+CD93W03I42JiB70iVF49jNOjhLbH621sIwEk4w00wE:lh93WEI4WiR04F49jNOjpuE4
Malware Config
Extracted
xworm
5.0
while-interfaces.gl.at.ply.gg:51728
K4svUfPf5qgPdS8d
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource VOID.exe
Files
-
VOID.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 102KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ