Behavioral task
behavioral1
Sample
Installer (2).exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Installer (2).exe
Resource
win10v2004-20240802-en
General
-
Target
Installer (2).exe
-
Size
52KB
-
MD5
aa1b896365785657ad24fd5d2f4a4b0b
-
SHA1
c7303991ffc1f6b51352c3cc394b99cb7850a2e1
-
SHA256
9597479583ba82b04d89f0da3a447a0e1bb06c35368d354c3b91334057940240
-
SHA512
8d4be6bdbe5a5c7571865a389e425cb7c98bbb76960faf8943a7d81188fa3efc2c5d12982b04b475849bdc2aeb8889de117c14126d6a42382ea7241ff58bff94
-
SSDEEP
1536:qwdFswZhYSUXz8ozkbv1rDxK6JOO1LUV:PFswAFXz9kbv1rvOO1Li
Malware Config
Extracted
xworm
since-searching.gl.at.ply.gg:64197
-
Install_directory
%ProgramData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Installer (2).exe
Files
-
Installer (2).exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 49KB - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ