xtodce | Triage

Sharing

General

Target

xtodce
Size

389KB
MD5

a230112e7c2cad11dc7901b548b33432
SHA1

49767fe1f274e2c9b6f5ea98670aabb2bf6b47d8
SHA256

fe56579ed19cbc5c5574eed879e5638d86f693e905ce72b9f73eb873b7179536
SHA512

bfe8862d03862c2190220b0de16aa09c56fe4d5798b23780ae858a1d92338e22710ce652132ab3930e3d4ee2c4b709a83c8d28649be09196f51031bf456c3c2c
SSDEEP

12288:PRjv4Yokxs8njjd+XJA53r74fneNmbRVlz7DJ+G:PR74EeqjjmA53jSblPDJ+G

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
xtodce

Files

xtodce
.exe windows:6 windows x86 arch:x86

93d38faa538d34592b2dd571bcadf806

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoUninitialize

kernel32

ExitProcess
GetCurrentProcessId
GetCurrentThreadId
GetLogicalDrives
GetProcessVersion
GetSystemDirectoryW
GlobalLock
GlobalUnlock

oleaut32

SysAllocString
SysFreeString
SysStringLen
VariantClear
VariantInit

user32

CloseClipboard
GetClipboardData
GetDC
GetSystemMetrics
GetWindowLongW
OpenClipboard
ReleaseDC

gdi32

BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
DeleteObject
GetCurrentObject
GetDIBits
GetObjectW
SelectObject

Sections

.text
Size: 241KB - Virtual size: 240KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

kidf
Size: 91KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE