Behavioral task
behavioral1
Sample
test.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
test.exe
Resource
win10v2004-20240709-en
General
-
Target
test.exe
-
Size
74KB
-
MD5
2a30855f5ffc49691ff6045485d3bd3f
-
SHA1
b1d5b51c46987f9fb10b32639ced2bf0c5a107af
-
SHA256
4658f7c74beaf35cda2ecf15e8832954e8d028ad707372bced2c1cf535183887
-
SHA512
fcbb82b6005ae58966d9e3233fe77e613a24fbeeb1ec4e354edf8a7f7e10eac62fa1c157cbd407305ec7055ec0d641f56b6d8efda1c1e44604801d4bd4c83e46
-
SSDEEP
1536:vPgDRKpEl0YPVQh09EHXPBkb4FCim0bTC6kQvObYYOXVg6eQb:vPYRKO1Mv/Wb4FCSo9cYOX+6Tb
Malware Config
Extracted
xworm
-
Install_directory
%AppData%
-
install_file
USB.exe
-
pastebin_url
https://pastebin.com/raw/sGaZ7csB
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource test.exe
Files
-
test.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 72KB - Virtual size: 71KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ