Behavioral task
behavioral1
Sample
4724b368372dca7b170e7eb20be9125084326a98c7e5012d031f6524717afaca.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4724b368372dca7b170e7eb20be9125084326a98c7e5012d031f6524717afaca.exe
Resource
win10v2004-20240709-en
General
-
Target
4724b368372dca7b170e7eb20be9125084326a98c7e5012d031f6524717afaca
-
Size
86KB
-
MD5
a7a33dd55213a4e5f16c5a85d86cd1e7
-
SHA1
52e331495f5be338dc34994a325dea3809133346
-
SHA256
4724b368372dca7b170e7eb20be9125084326a98c7e5012d031f6524717afaca
-
SHA512
34720be9d086b062e41dd0df26164b95a4561075807e3716822b1c15f84ac949e0769dea70423b068a7347f5156ca05f37054f8d50f965ec95fc78f03cf77617
-
SSDEEP
1536:F++T50Sjafj6PHEuXYotCAdNmZBLUbukAhB6teF+ZOZbEHd32:F++T50b6HzV4ASAbuvw0+ZOBE92
Malware Config
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4724b368372dca7b170e7eb20be9125084326a98c7e5012d031f6524717afaca
Files
-
4724b368372dca7b170e7eb20be9125084326a98c7e5012d031f6524717afaca.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 83KB - Virtual size: 83KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ