XClient-obf[.]exe | Triage

Resubmissions

09/09/2024, 20:13

240909-yze4tsxfqn 3

09/09/2024, 20:12

240909-yy6kdszcnc 3

Sharing

Copy URL Twitter E-mail

General

Target

XClient-obf.exe
Size

186KB
MD5

62ca922962d2f9430dd3acb6de090c69
SHA1

42bdb511a25d5de4f9ad84c956c5ae0c1e0b8a34
SHA256

4cc2c022db99cb51c55279cf9e3434e8409ea88310692134bcb915e7d26c15f9
SHA512

3ec8c15eaf190c668f595726c4e951d318cc665ed51cc23c335039684d5fab2a8f653689ad1c3439895ad9c313ac306b2a9011aa0cdee262e86f7782e4c7cc2a
SSDEEP

3072:GtKKgLjnr3ds/sIYJEMyeogdFQT1jMyyup0bupNYE4SkZxP+pNp3mxrwmWyizaRl:rKgLjr3ds/vYuAogmac0bOYE4SkZxP++

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
XClient-obf.exe

Files

XClient-obf.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

u5hU
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 118KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.foo
Size: 512B - Virtual size: 22B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ