General
-
Target
ShellExperience.exe
-
Size
94KB
-
MD5
2bf7a8f812b079dc8319a76d67eb88fa
-
SHA1
84eb63daa0bb7c1052da5d8c2dd2b82cf2be2b64
-
SHA256
3150d0efff068e6f2963891667085ff0b7e841b2208e0bddb368c05246bb8829
-
SHA512
6aed3c34d4f6991755432aa3c5b8f11ccaba5796118ffe64d2d912d1132ab1cd6250be76536a1640332cb0f8d5d56406683443722dd2f499973025929bf308ba
-
SSDEEP
1536:q2bxcRngtUyosQVElr6kqmEyCB9bcqtyn/IjWuUHNNPROBDB4u/v7IVn1ksZu3J:F1UngGyoRV22kqm89bfty/znNJROxB4u
Malware Config
Extracted
xworm
proxey.publicvm.com:1003
-
Install_directory
%ProgramData%
-
install_file
ShellExperience.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ShellExperience.exe
Files
-
ShellExperience.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 91KB - Virtual size: 91KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ