XPA[.]exe | Triage™

General

Target
XPA.exe
Size 789KB
Sample260607-q1c2vsfv3k
SHA256 cc72b42c5ead241222e935eaf10144a2a3a56ec492bbefb46eb78ebdf04f87cc
MD5 98887ebaac9fe0d1fa9433f9d8811201
SHA1 c9c6c474a014b1cff3f38398c6f329e053302c51
SHA512 dbcf6251e70a937b6de60bc2ea9f65f3efaf1f3afa3759624707489dc729e5877e9b02a4b19a940d74a305179e91738fef85f4a4b0d2028cc2a8acae8f306091
SSDEEP 24576:sAEdXtLgSod+vCjiQK7dW9aCYOTAUNqBqgxIBWFb67jbTWs+4HDwx2UPY4BEA2A3:49j/pM8juMMkpLx3Q92/Pmbe
TLSH
T1830507CF41A459D5E4787373C02AFB1EAA39BCE964A151CF1A673320FE384498D1B636
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
XPA.exe

File Explorer

XPA.exe

.exe 789KB

XPA.exe

SHA256 cc72b42c5ead241222e935eaf10144a2a3a56ec492bbefb46eb78ebdf04f87cc
MD5 98887ebaac9fe0d1fa9433f9d8811201
SHA1 c9c6c474a014b1cff3f38398c6f329e053302c51
SHA512 dbcf6251e70a937b6de60bc2ea9f65f3efaf1f3afa3759624707489dc729e5877e9b02a4b19a940d74a305179e91738fef85f4a4b0d2028cc2a8acae8f306091
SSDEEP 24576:sAEdXtLgSod+vCjiQK7dW9aCYOTAUNqBqgxIBWFb67jbTWs+4HDwx2UPY4BEA2A3:49j/pM8juMMkpLx3Q92/Pmbe
TLSH
T1830507CF41A459D5E4787373C02AFB1EAA39BCE964A151CF1A673320FE384498D1B636
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

8c:b8:c1:15:02:27:5c:01:04:82:fb:f5:bf:63:64:fb:6d:f3:a5:39:a0:38:1a:0a:1c:ad:6e:cc:42:39:a3:57

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

NO CERTIFICATE

Chains

Jan 1, 0001

Minor OS version

0

Major OS version

6

Entry point

215664

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

AUCAttestation AccelerationColliderExchange AcceptShadow AcceptTickInit AccordionStateECN ActivateBandwidth ActivateElevation ActiveEpoch AdapterDaemon AdaptiveAttestationEvaluate AdaptiveRoute AddVelocitySwipe AggregatorAdapter AlbedoGatewayDynamic AmbassadorCrossEntropyPinch AmbassadorEphemeralProject AmbassadorFocus AmbassadorTTL AnimateBlueGreen AnimateMeasurement AnisotropyRate AnisotropyRotate ApplyForce ArchiveVelocity AttentionResolver AttestationGraceful AttestationPerplexity AuthorityDecapsulate AvatarMeasurementBatch BackPatch BackoffConclude BackoffCron BackoffLinear BackoffNavmeshPrecision BackpropHelper BackpropNextHop BackpropTile BadgeResponsePepper BaggageRagdoll BandwidthSpacing BatchCompact BatchEvaluate BeamTTLGesture BiasAccept BindingFreeze BiometricEdge BleuPropagation BleuShadowReshard BloomCancellationResponsive BlueGreenTrain BorderECNHydrate Boxcast BreakerRetrySnap BreakerSuspend BurstShadowRetry CEExpire CEGapMinibatch CEHandler CESuspend CancelAnimateBurst CancelSpan CancellationSwipe CarouselBTreeSwipe CarouselDemultiplexSpread CellGraphKey ChallengeBackprop ChallengePool CheckboxParticle CheckboxPublisherDeadline ChunkAmbassador ChunkHeuristicAdaptive ChunkPong ChunkProcessor ChunkRefresh CircuitAdjacencyFilter CircuitGraceful CircuitRoute CircuitSetDrag ClaimLatency ClassRankMinibatch Classify ClothStatelessRevoke ClusterAcceleration CommitMeasurement Compact CompactDeployment CompactionPacketLoss CongestionPacketLossTrigger ConstraintChunkExpire ControllerLongPressSpacing CorruptProvider CostDecapsulate CostViewportPool CredentialLinear CronCircuitBreak CronEnclaveFlip CronHelper CrossEntropyRank DamperWaypoint DeadlineInsets DeadlineRankPerplexity DeadlineRigidbody DecoderDiscoverRefresh DecoderLiveness Deprovision DialFlushChunk DialToggleJoint DiffBreakpoint Discover DiscoverBandwidth DiscoverVacuumEphemeral DragDeploymentMinibatch DragDiscover DragMoveTowards DragNormalize DragSmoothDamp DropdownDisabledOrchestration Dropout DropoutSkip DungeonAttend DungeonCardDeadline DuplicateTTL DynamicTimeout ECNWrapper ECTApplyTorque ECTInit ECTResolver ECTStartup Ease EaseSpherecastDuplicate EgressThrottleBandwidth ElevationCronPrecision ElevationEmitterInfer EmbedAnisotropy EmbedBleu EmbeddingCircuitBreak EmbeddingDenseLOD EmbeddingProjectMirror EmitterDropped EmitterHeuristicClassify EncapsulateCollider EnclaveFillPool EnclaveLatencyPropagation EnclaveStandardize EncoderStepperDrag EncoderThrustFeedForward EndpointCompactRoute EndpointDamperSpread EntropyMemtableConclude EpochFixedUpdate EpochGradientDropped EpochLerp EpochMAPOrchestrate Evaluate ExponentialHydrateDamper ExtrapolateROC FailoverInit FailoverRespawnEphemeral FillAdjacencyMatch FilterAmbassador FilterMargin FilterStepInterpolate FlexProxyDSCP Flip Flush FogJointGraph ForceCostIntrospect FreezeDrag FunctionMeasurementBackprop GatewayAccelerationDuplicate GatewayLateUpdateBackprop GatewaySpecularAUC GatewaySpring GoodputSample GradientAttentionToken GradientRankTrace GradientRebuildAttention GradientRollout GrassDuplicate GrassEncoderShadow GrassJoint GrassZoomedRoundTrip GreedyBinding GridNavmesh Handshake HandshakeBiomeHop HapticDSCPRebalance HapticValidate HeadConsumer HeadHelper HeadPepperExchange HeightmapInit HeightmapStandardize HeuristicCorruptAdjacency HeuristicHandler HopAdjacency HoverResumeDeadline Hydrate HyperFlipMeasurement Infer InferAdapter InsetsManager InsetsMask InsetsPepperNAT Interpolate IntrospectAdapter IssuerStatelessAnisotropy JoinerFlexElevation JoinerTunnelAUC JwtDrag JwtRenegotiate KnobIntrospect KnobNextHop KnockbackSalt LODPersistent LagMemtableRotate LatencyApplyTorqueResponsive LatencyBack LatencyBoxcastStep LatencyParticleAUC LatencyVacuum LayerDetect LearnerBeamConclude LeaseMoveTowards LerpInterpolateBorder LiftBreaker Linear LinearEpoch LivenessMigrateBorder LogitPurge LongPressConstraintInit LongPressPacketLossRate MarginJitterSlide MaskProjectOrchestration Match Memtable MeterForceful MetricResponse MinibatchRadius MirrorProvider ModalFragmentResponsive MountResponsive MoveTowards MultiplexAmbassador NavmeshPersistentReorder NeuralArchive NonceAttendAcceleration NonceElevation NonceRaycast NormEmbedStateless NormalizeReadinessParticle NormalmapInit OcclusionGradientResponse OffsetMatch OperatorParticleInsets OrchestrationArchive OrchestrationDaemonFocus OrchestrationRouteBackoff OverlayStartup Pad PadPoolMask PaddingAttestationZoomed PaginationDecoderRoundTrip PanePepperPan ParticleMAP ParticleShadow PartitionClassPinch PasskeySpherecastDamper PatchPositional PatchRoute PatternLODShrink PatternQueryHeuristic PatternRigidbody PeerSpringEmitter PepperPool PerplexityHydrate PerplexityMoveTowards PerplexityStepDropout PerplexityTTL PersistentECTFailover PinchHandler PinchProvider PinchTeleport PingDuplicate PingLatency PlaceholderOverlap PongToken PoolBaggage PositionalConstraintUnmount PositionalVacuum PrecisionFlush PrecisionProvision PrefetchCompactionChunk PressedInit ProbLease ProbResponsiveGoodput ProbeDropoutTrace ProjectBoneBandwidth ProjectSkip PropagationCanaryMask PropagationChallengeLateUpdate Provision ProvisionRepairRotate ProvisionSlideSoftmax QualifierSkip QuorumRotateTowards QuoteKinematic QuoteStatelessF ROCTeleport RadiusSample RagdollCanaryReorder RagdollChunkHealthCheck RateBurstSpherecast RateLimitWrapHead RateTunnel RatingVacuum RaycastCancelValidate RaycastChunk RebuildLogit ReconcilerFragmentMargin RefreshPropagationPepper RefreshTTLAUC RefreshThrottle RegressDuplicate RegressExpireVortex RenderMemtableMeasurement RenegotiateVelocity ReorderMirrorLateUpdate ResidualManager ResidualValidateReassemble Respawn ResumeMirror RetryResponsive RevokeAmbassadorRetry RevokeExchange Rolling RollingRotate RotateTowardsActivation RotateTowardsElevation RougeManager RougeTileVacuum RoughnessSpinnerVelocity RoundTripResolver RouteFocus RowAlbedoAcceleration RowCompactionFill RowKnobEdge SafeAreaProcessor ScaleValue ScheduleBinding SealPadding SelfBackpropValue ServiceRespawn ShadowHeuristicLOD ShadowRender ShardReassembleInit ShrinkSimulatePositional ShutdownRebuildTTL SidecarRate SidecarSample SkeletonThroughput SkeletonTopologyBack SkinLagRigidbody SliderMirrorLatency SmoothDampProbeTap SnackbarComboboxBleu SnackbarOrchestration SnapshotMountTile SnapshotRecommendCost SpacingInsets SpacingJitter SpacingWrapper SpanPatternAnnounce SpanRateSidecar Spherecast SpreadHover SpringOrchestrate SpringSealCollider Startup StartupCorrupt StartupGradient StartupUnsealDuplicate StateTokenize StatefulHelper StatelessBindingBreaker StatelessManager StatelessProcessor StatelessTokenize StepRoughnessRagdoll StepStepStroke StreamerCompactAcceleration StubAccelerationPinch StubAttendNavmesh StubMinibatchParticle SuspendSnapshotFilter TTLAnisotropySpan TTLBleuTrace TTLKeyRotate TTLRoundTripMerge TapCircuitPrefetch TapGraphHandshake TeleportCompactionPropagation TenantResponsive TextureMount TextureRotateCancellation TextureTruncate ThroughputElevation ThrustRollout ThrustSidecarBorder Tick TickStroke TileLogitGraceful TileOrchestrate Timeout TimeoutFlip TimeoutProject ToastGradientDrag ToastInterpolateBinding ToggleMargin TokenActivate TokenHeartbeat TokenizeMeasurement TopologyBurst TopologyDiff TopologyNodeJitter TransformerKnobRoute TransitionFlipPan TriggerDropped TriggerInterpolate TurbulenceBreakerSample TurbulenceConsumer TurbulenceNDCG Unmount UnmountPrecision UnmountQuote UpstreamSpringStroke ValidateConsumer ValueMultiplex VectorECNGap VelocityProcessor VolumeHapticValue WarmReorder WaypointHandler WaypointRouge WeatherAcceleration WeatherDeadline WeatherLabelCancellation WindPacketLoss WindowPortalThroughput WrapCollider ZoneActivationCollider ZoneBiomeCanary ZoneDSCPEmitter ZonePositional ZoomedMoveTowardsDeployment

Name

.text

Size

210KB

Virtual Size

210KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

263KB

Virtual Size

262KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

408B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

278KB

Virtual Size

278KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

XPA.exe

PE Signature issue

generic