Behavioral task
behavioral1
Sample
778bd2563876be9879c373b0055d5602ae439de130bf542ddca8240d58a281ce.exe
Resource
win7-20241010-en
General
-
Target
778bd2563876be9879c373b0055d5602ae439de130bf542ddca8240d58a281ce
-
Size
195KB
-
MD5
ed310e73ae207d734f4df174aafc0647
-
SHA1
02602d13c956efd440216066d3a9e48d27952982
-
SHA256
778bd2563876be9879c373b0055d5602ae439de130bf542ddca8240d58a281ce
-
SHA512
e3a4196d78fccdc9fbba606407b547bdb8de7ff109fa541f5b2c27208f212788d74eabd1dca94ea1a9a966fc169d914d7484a24e576d9bb6ad8d0dc1bc359a4a
-
SSDEEP
1536:Kd9OW/63U4epFE9jdOjYGxBanqY5DW1V:Kd9Z/pFE9jdOjX8rDcV
Malware Config
Extracted
xworm
5.0
next-block.gl.at.ply.gg:58505
mmiqE49Ioe8HLOMA
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 778bd2563876be9879c373b0055d5602ae439de130bf542ddca8240d58a281ce
Files
-
778bd2563876be9879c373b0055d5602ae439de130bf542ddca8240d58a281ce.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 164KB - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ