Behavioral task
behavioral1
Sample
2a05c89d5d66173d80745b54558ce867c333f4d458ad48f3454291991eb7f3ed.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2a05c89d5d66173d80745b54558ce867c333f4d458ad48f3454291991eb7f3ed.exe
Resource
win10v2004-20240802-en
General
-
Target
2a05c89d5d66173d80745b54558ce867c333f4d458ad48f3454291991eb7f3ed
-
Size
64KB
-
MD5
b4b3fa320b05128251652afdc024da62
-
SHA1
af5b3ecb07618bfd62f95b6d722b084e537216b7
-
SHA256
2a05c89d5d66173d80745b54558ce867c333f4d458ad48f3454291991eb7f3ed
-
SHA512
7e8610de9b0472091129135069b1b30a0815e221173b8391dc1ab89e50bd84b7b59853a14ef1187d7fae61e74f7447398f868d52fc3daefabcb8985298b70cad
-
SSDEEP
768:MzKeuw7mMDFDQAkYS3vCyzC+5WpWVFq9JRqLOMhMuxZ:M9bDg5deHpGFq9JELOMyu
Malware Config
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2a05c89d5d66173d80745b54558ce867c333f4d458ad48f3454291991eb7f3ed
Files
-
2a05c89d5d66173d80745b54558ce867c333f4d458ad48f3454291991eb7f3ed.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 33KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ