Behavioral task
behavioral1
Sample
new.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
new.exe
Resource
win11-20240802-en
General
-
Target
new.exe
-
Size
141KB
-
MD5
f46d2d9084ebabc4991eebf7a0ca235f
-
SHA1
75e2fd5816d73d934056cf4960bbc6cf35f27d7d
-
SHA256
76136a31c3e738be6ba7ad8bf6014612de354f32c927a81c4abed7b246f6f9ca
-
SHA512
02a7d3b236580acee3df2def3f8ffcdff73d0a65ab87e3e17d9795b9467a1394841b21e4b8a3c3fad3a917ab5ea687c8b3083c315ec24b0f27933405a56c5a98
-
SSDEEP
1536:dU0WXLCWarS5jd8D629/ummx74nbNJqC9k19bV37FaNsYk/O/c6:dU0ULirMjWZmGRu9bVgNDQO/h
Malware Config
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource new.exe
Files
-
new.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 138KB - Virtual size: 138KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ