Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
General
-
Target
x4Rootkit.exe
-
Size
8.4MB
-
MD5
88243d0aa7a248e97e273ba0fca05d80
-
SHA1
886898b2e794c3f32ceed3ef1bfd8bd8f1e003ba
-
SHA256
0c98ffe995b53e4923f4401b8c45a3e459b0580fa2197bb69490708a539f074b
-
SHA512
60984ee504ca3048d83e9d14b0a9fb0c39ddb6cae4397a8627aabda8a93ad5c361dabb684151077138b991df12cc0b1130899e386f815aa57f1cb2ddad145715
-
SSDEEP
196608:JxN3xtkZcjp9Q2U+PYk3UriXbHbiIJmdUl7V9rKDl:PN3xSYUH4ariKIF7V8p
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource x4Rootkit.exe
Files
-
x4Rootkit.exe.exe windows:4 windows x86 arch:x86
Password: llllllllll
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 8.4MB - Virtual size: 8.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ