Behavioral task
behavioral1
Sample
be5e4c1450e7673500206a30bc02b96351906d45522e137a687c9f93eced0614.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
be5e4c1450e7673500206a30bc02b96351906d45522e137a687c9f93eced0614.dll
Resource
win10v2004-20241007-en
General
-
Target
be5e4c1450e7673500206a30bc02b96351906d45522e137a687c9f93eced0614.dll
-
Size
2.9MB
-
MD5
32936373efb0ed64f9f0c4e7758092b1
-
SHA1
f65e5b36d525688f89ce69c2312816d70bc0477d
-
SHA256
be5e4c1450e7673500206a30bc02b96351906d45522e137a687c9f93eced0614
-
SHA512
91c6f7468e07be5199181bb54bda70f417c2db293d8fc475184cf085c14ad4e4aba77bce5cfd9e032d1ab3f8761078ed46d4b3381c76414817480377ac4c6569
-
SSDEEP
49152:PO9hnRJ/JjXTVFi0en/CLDzKv63Tu2jj6Sq03xg/pOFMy:PO9hnH9XTVFd2/CGv63T/5
Malware Config
Extracted
xworm
5.0
crypters.ddns.com.br:7000
GGGrHP0Odh89zLnb
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource be5e4c1450e7673500206a30bc02b96351906d45522e137a687c9f93eced0614.dll
Files
-
be5e4c1450e7673500206a30bc02b96351906d45522e137a687c9f93eced0614.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ