Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
test.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
test.exe
Resource
win10v2004-20250217-en
General
-
Target
test.exe
-
Size
59KB
-
MD5
0989805ebfa10a6112b1e19846182c95
-
SHA1
9c101d98d26c6d5e2374e4d8baab393631d358d8
-
SHA256
412621eea530f0835ff50ff44c174b55d45fd36400319b054788920535b7d586
-
SHA512
c96cbc20c5bf93cac574fa6795bc413f7a8e0becab5343bf824819ab9443ae41fd05ec5976ba89888b97aef5e95df561b7f1e57d2251ebb9dfcd5348e044d602
-
SSDEEP
1536:2nF3FOqPlMQvp7eq6IzbhY1iv2n+u65n18ZCOmTzg5:2nFxPqG7YIzby1B+118IOmTU5
Malware Config
Extracted
xworm
3.1
Jameson1312313-53869.portmap.host:53869:8848
-
Install_directory
%AppData%
-
install_file
fortnite.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource test.exe
Files
-
test.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 57KB - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ