Behavioral task
behavioral1
Sample
ed75ef4bd376a3d6afe90487c3398b9b89bdc0d503a5906563f985af7862995d.exe
Resource
win7-20241010-en
General
-
Target
ed75ef4bd376a3d6afe90487c3398b9b89bdc0d503a5906563f985af7862995d.exe
-
Size
32KB
-
MD5
5ebe16ac906d816b17510357377fbb01
-
SHA1
99cc1946ea1f5757a93bbfef16cd276b88713209
-
SHA256
ed75ef4bd376a3d6afe90487c3398b9b89bdc0d503a5906563f985af7862995d
-
SHA512
79593cc9c716d731c1e2eaf97f4a06217e6e5aae55145333d11c87264e66efd76ae90a84149a865eaf6a414885ab14149a01be8bba2170223123f7e5445dfb82
-
SSDEEP
384:bEbmX5Qa+vN1h1+X3v6JFjL+g93Tm2eaFO4FzRApkFTBLTsOZwpGd2v99Ikuisqd:oVa+vNtg+PB93Tw49FzVFE9jTOjhOb4+
Malware Config
Extracted
xworm
5.0
127.0.0.1:7000
i709h2VhFlRsldOu
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ed75ef4bd376a3d6afe90487c3398b9b89bdc0d503a5906563f985af7862995d.exe
Files
-
ed75ef4bd376a3d6afe90487c3398b9b89bdc0d503a5906563f985af7862995d.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ