Behavioral task
behavioral1
Sample
XWorm_Installer_v5.6_CRACKED_WEB.exe
Resource
win7-20240704-en
General
-
Target
XWorm_Installer_v5.6_CRACKED_WEB.exe
-
Size
212KB
-
MD5
1944352777346eb61474af431456f69d
-
SHA1
c186adfb49fd75cafb2dcdc27335f3fabac98ba3
-
SHA256
42bbd1111a65c99ddaf546defa047e8625e23e3585b6fc6fd620a3ea960fb0a7
-
SHA512
af55e4a3e02c44b6eb705e356e0ac08a4d5d02733bad15b589d3e5710140d5953ab056ce152b9b0f9c422a688d3bb9520ddb6d82220f6b1e5b3eb33c3259d9a7
-
SSDEEP
3072:oe4F71eEFiEcsCbjP37nPO3JomEM4A2ewhLapuvpAsZOyMqmyBeYVYe:oe9jEcsCbj3Iq/GWGwqqm1
Malware Config
Extracted
xworm
continue-singing.gl.at.ply.gg:4436
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource XWorm_Installer_v5.6_CRACKED_WEB.exe
Files
-
XWorm_Installer_v5.6_CRACKED_WEB.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 74KB - Virtual size: 74KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 137KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ