General
-
Target
EdgeServices.exe
-
Size
87KB
-
MD5
272c86db433f487a381decab3d54a4c9
-
SHA1
92b27cbd371930452c9f922eadc5a5f5207ebad0
-
SHA256
b6521db2b4ebfd6e5894fe144f24651f604f1d72316e35e4345bc685b77299e9
-
SHA512
c1e43a4fd65596db6622d58c0069fd26c62aca3a87be1a919845a6e30b8df3897b150365551ff587d800716f68a0a7f124ac483caa36a28ed651fb1ac40b820f
-
SSDEEP
1536:57BcrsAWIVvu4XBD5l45bUz1P9c13t6vSSYeOeNUjU6R8gdq5:RqreIk4XJ45byF963SLYeOeNYJ8j5
Malware Config
Extracted
xworm
mail-transsexual.gl.at.ply.gg:9313
-
Install_directory
%Public%
-
install_file
GoogleServices.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource EdgeServices.exe
Files
-
EdgeServices.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 85KB - Virtual size: 84KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ