General
-
Target
XClient.exe
-
Size
165KB
-
MD5
09100563551b9e2ff5522bd424995ea4
-
SHA1
99959a304d885010a160acc205a05dc913174ee4
-
SHA256
4baef667ce060991fb4bf9a5b3d2609e1d66b6f9420c22a0d17459f57cdf4c72
-
SHA512
5765ef1dd46d3727db6c41da0eead854cc24b6711cb5b7244eb9e5115994d571756da755fc70ba8df1d5c95d742e87f0310c5df7080d015c9d23a0f85eaa7b71
-
SSDEEP
3072:uvr20nxaFM9zjOMgRUGKXs+S++7KFSbxeY+qDDrMK:Ur2keM9DGqStKEbxI
Malware Config
Extracted
xworm
5.0
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource XClient.exe
Files
-
XClient.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 127KB - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ