Behavioral task
behavioral1
Sample
307eeddf9b320549ba57b333714bb5d0N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
307eeddf9b320549ba57b333714bb5d0N.exe
Resource
win10v2004-20240802-en
General
-
Target
307eeddf9b320549ba57b333714bb5d0N.exe
-
Size
126KB
-
MD5
307eeddf9b320549ba57b333714bb5d0
-
SHA1
654b78e34d8823b79541ea8c7708292ab9486e8b
-
SHA256
dffac616b1d73232824394762d0fd3a99ee19e63eff13aec12368002ea0bdd0b
-
SHA512
010379eb2c8e7c3e8b53c281d59de95fa4e9558054d1d39f88b96fa54bc083bbbd3a9823c8076c34a4791a4761ec8a73a879acb7959ac77df7df929ac6fcf576
-
SSDEEP
3072:2WOBWY8bITZF094vOjgv3nuxy5Spr4FjyHdmlyhAT:2WOBWFIz09CXu45qcFj4I2A
Malware Config
Extracted
xworm
5.0
google-gentle.gl.at.ply.gg:38573
127.0.0.1:38573
v9b0N0pKbGsaqczB
-
Install_directory
%AppData%
-
install_file
DayzCek.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 307eeddf9b320549ba57b333714bb5d0N.exe
Files
-
307eeddf9b320549ba57b333714bb5d0N.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 33KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 92KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ