Behavioral task
behavioral1
Sample
XWorm.exe
Resource
win7-20240611-en
General
-
Target
XWorm.exe
-
Size
108KB
-
MD5
4e771d8ab93962867d6ff4bf1683eefa
-
SHA1
6703a4d4fc7abc5f00b5769740822c0bb70c2a8d
-
SHA256
aac41ab4f44400f9be9d38bea40f5ecc6dffe9b2a0ff77be9017cb0cac956c8f
-
SHA512
1f33354dd99d0faa2828b88c3128fc6f9953e2194e22e46f4c0732b7736ad85d1cb0df0cc2fb0867dd734120b3e59204ea9aa231ceb1d839e12902b4d39f49d9
-
SSDEEP
1536:ti9e1ny4P32ph+HVc6t+UQvHDG0jg0w3Uf3LLpIVPjfqdeXrI:s9e1nyhh+1c6ED/jg6f3LLpIVLEZ
Malware Config
Extracted
xworm
meet-showtimes.gl.at.ply.gg:33561:33561
ccxFAV0dZFOG0nh1
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource XWorm.exe
Files
-
XWorm.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 69KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ