General
-
Target
Test.exe
-
Size
44KB
-
MD5
6fe5311ce8a5543ab792d5f83c174f94
-
SHA1
6d3a1c61379845792200d1a3c4eebcfd7ca21317
-
SHA256
6afe1bc69d94134674ac7a17ba9b6cc5e721fc8fa530fe71a3a95c6f093e12d1
-
SHA512
39e34e74138bf1df1f1136d13a9f34c60cb2f92d644e90c6bc0eafe96e0c50e59fcb308a20c7a48b5b2107460abe77a4d34858c83bce2b9cc466b437db58cc42
-
SSDEEP
768:YXKozr3oH1B39vMA4XUlw7xOVu6EVuLVabFEPC9Orc3W6BOuhvzjuz:YPzkHFaklSOx5MF39Gcm6BOutw
Malware Config
Extracted
xworm
5.0
growth-planning.gl.at.ply.gg:48210
OerIqTklGpGkpx8J
-
Install_directory
%LocalAppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Test.exe
Files
-
Test.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 42KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ