Static task
static1
Behavioral task
behavioral1
Sample
xHancer.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
xHancer.exe
Resource
win10v2004-20240709-en
General
-
Target
xHancer.exe
-
Size
316KB
-
MD5
06ccac1ece8ef8948ee261f34e6cab3c
-
SHA1
092201bd10c753082e586cd8112633426a3b34ba
-
SHA256
d4f96bf21fba6ed6b7405d7d6e7fbd8becae98c1ecb062ca5f882d092437da45
-
SHA512
d02d2754110a5172bb69d6ad4b4eeb38a8e19a2736dbcf6b9eedc14d12a874872e8584121d7818b2d160e9fcf2289402df73deb8dc48b0ada72a637803475b4a
-
SSDEEP
6144:TfAEOTeHyKq/JgjffrIjjeHZvsoj8y8tixAXJerOI6tJlsZ7WbcVmZmjLdSsaq6:jAHTeHL7fcjUvGtzX++U7WbcVmZmjwsZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource xHancer.exe
Files
-
xHancer.exe.exe windows:4 windows x86 arch:x86
2e617e493fe56f5d85bc653115a984fb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateThread
FindFirstFileA
GetModuleFileNameA
ExitProcess
CloseHandle
CreateRemoteThread
GetProcAddress
GetModuleHandleA
WriteProcessMemory
VirtualAllocEx
Process32Next
Process32First
CreateToolhelp32Snapshot
Sleep
OpenProcess
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetStartupInfoA
GetCommandLineA
GetVersion
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
GetLastError
SetFilePointer
GetCPInfo
GetACP
GetOEMCP
HeapAlloc
VirtualAlloc
HeapReAlloc
LoadLibraryA
SetStdHandle
MultiByteToWideChar
FlushFileBuffers
user32
MessageBoxA
DialogBoxParamA
EndDialog
Sections
.text Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 288KB - Virtual size: 287KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ