Behavioral task
behavioral1
Sample
38b88caf1dd809c6d77d8addce355a3e35dccab52f15ed67491437a49bace226.exe
Resource
win7-20240903-en
General
-
Target
38b88caf1dd809c6d77d8addce355a3e35dccab52f15ed67491437a49bace226.exe
-
Size
36KB
-
MD5
70eaf49a98e12f4d4de3c019c0baad11
-
SHA1
b48fa964e0c99e49ff2e9d4d74e2ead1457d9dcf
-
SHA256
38b88caf1dd809c6d77d8addce355a3e35dccab52f15ed67491437a49bace226
-
SHA512
2bafea3ab77685af33ee7b24ad4b84e6dfec5ea454815b9ccee522246a964ddaec4538d58f1d17090b80daf4a14a7476b35d2215bdaca49ddf8cc873e6ce3377
-
SSDEEP
768:vL13A5Uno9RfHWa2B71eo8icHyEWbFb9YyOMhSQXv8M:jxA5Uno9JHWXZeNicHyESFb9YyOM468M
Malware Config
Extracted
xworm
5.0
85.31.47.24:1888
ElNqLr9sSzibVsM9
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 38b88caf1dd809c6d77d8addce355a3e35dccab52f15ed67491437a49bace226.exe
Files
-
38b88caf1dd809c6d77d8addce355a3e35dccab52f15ed67491437a49bace226.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ