Behavioral task
behavioral1
Sample
afeacceb82b755fdf7811b0ed8d1f7641840cee2b503b1fad954f109104b88a0.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
afeacceb82b755fdf7811b0ed8d1f7641840cee2b503b1fad954f109104b88a0.exe
Resource
win10v2004-20240802-en
General
-
Target
afeacceb82b755fdf7811b0ed8d1f7641840cee2b503b1fad954f109104b88a0
-
Size
41KB
-
MD5
5ecc78d878f619f6b063a6c41ef7b816
-
SHA1
41f1799bea4fba0314df040b0fdb8429f1fa318d
-
SHA256
afeacceb82b755fdf7811b0ed8d1f7641840cee2b503b1fad954f109104b88a0
-
SHA512
39abe170f65c180eeff2db78ab9905702557c916a16c5e085a16886d1f974021fc38738531d24b8e3219c94d7389fe1869a72c03cf20898c987c73812f26c98d
-
SSDEEP
768:QRPD9OQhx/BV3Tw4hFzVFE9jnOjhRbOds4S1EAd8IIR:Qd9OW/V3U4hnFE9jnOj36dS1EAd8IIR
Malware Config
Extracted
xworm
5.0
127.0.0.1:7000
wime7.hopto.org:7000
4i2iVsaByzGYeJ9b
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource afeacceb82b755fdf7811b0ed8d1f7641840cee2b503b1fad954f109104b88a0
Files
-
afeacceb82b755fdf7811b0ed8d1f7641840cee2b503b1fad954f109104b88a0.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ