Behavioral task
behavioral1
Sample
9a72ac088cdb791f5fa2ffe3fbc1102dfb645a7d39709aefdd94f5c00ac6d581.exe
Resource
win7-20240903-en
General
-
Target
9a72ac088cdb791f5fa2ffe3fbc1102dfb645a7d39709aefdd94f5c00ac6d581
-
Size
67KB
-
MD5
92751193d8345fc63360076ebf20401c
-
SHA1
23ff390d576c03c23004b121170225102776abd2
-
SHA256
9a72ac088cdb791f5fa2ffe3fbc1102dfb645a7d39709aefdd94f5c00ac6d581
-
SHA512
1d0e4afee71381df99deff972c3539ff5e76148a820e29f418308f5ff73bf820c02d14796c1f59387fddfa787a5c280fea14535552931ee3fefa27f811280c10
-
SSDEEP
1536:ubva4rgI5/VnFRAIKebeNT3KdGchOd46Op6mwgnTii:Szzd3beYGch6OpFwih
Malware Config
Extracted
xworm
25.ip.gl.ply.gg:55007
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9a72ac088cdb791f5fa2ffe3fbc1102dfb645a7d39709aefdd94f5c00ac6d581
Files
-
9a72ac088cdb791f5fa2ffe3fbc1102dfb645a7d39709aefdd94f5c00ac6d581.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 65KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ