Behavioral task
behavioral1
Sample
ASpoofer.exe
Resource
win10ltsc2021-20250113-en
General
-
Target
ASpoofer.exe
-
Size
266KB
-
MD5
bc02803808b0fef29141032a807e855f
-
SHA1
c9d6339a10b06f4ad4175664c8728f6622d83855
-
SHA256
1670b4755805f0d523fba188435da1357c62562153db2b8fa5743ab9906e2c54
-
SHA512
2c27607c0c921e2d86a2e63bc7b2a0cea0df6f29d693ad9e91c16895ef348a6f415b2eaaeb74c41e25a65c3bd1c69578c78866725de6b1832f89f4283f71c0c3
-
SSDEEP
6144:YM+vTWbj7v/5bTgVziHzZnSKrCbYMBbX8Sq:YM+vo7v/5/gVziHlBrCbYq8b
Malware Config
Extracted
xworm
-
install_file
Mason.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ASpoofer.exe
Files
-
ASpoofer.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 261KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ