xworm[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
xworm.exe
Size 58KB
Sample260709-dp4n8ac13s
SHA256 dc65e7b07f61d5c9f75eb182f63a0d9f839335428007688e2666bdecc5991c7d
MD5 66d0620d047e5f97bbe18482faf9c897
SHA1 2ca765e824f9bd5c168ee54f27eb7936507af43f
SHA512 be2726834c3944a088c2fa8d0775d8317f85b4f29b8d2ea11b5c286c323b9656423ef7b4a3815d316fe65f758e76cd6c5038805440a06bcef16606f39dbfd5d6
SSDEEP 768:cP5d4+D0jRmW5SViQN4wKdm6909cvIBxYWTBV2qU:cB/D0VmW57jrF9nvIBxYWV8T
TLSH
T1BA435C0AFAB394EDC792D078C5E78732F8B1BC980529BF3E0650C1756D61B91EA3C952
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
xworm.exe

File Explorer

xworm.exe

.exe 58KB

xworm.exe

IMPHASH e87ba685fbef3da680ea301ce7613bdf
SHA256 dc65e7b07f61d5c9f75eb182f63a0d9f839335428007688e2666bdecc5991c7d
MD5 66d0620d047e5f97bbe18482faf9c897
SHA1 2ca765e824f9bd5c168ee54f27eb7936507af43f
SHA512 be2726834c3944a088c2fa8d0775d8317f85b4f29b8d2ea11b5c286c323b9656423ef7b4a3815d316fe65f758e76cd6c5038805440a06bcef16606f39dbfd5d6
SSDEEP 768:cP5d4+D0jRmW5SViQN4wKdm6909cvIBxYWTBV2qU:cB/D0VmW57jrF9nvIBxYWV8T
TLSH
T1BA435C0AFAB394EDC792D078C5E78732F8B1BC980529BF3E0650C1756D61B91EA3C952
MD5 SHA1 SHA512 SSDEEP TLSH

windows:0 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegCreateKeyExW RegSetValueExW

kernel32

CloseHandle CreateDirectoryW CreateFileW CreateMutexW DeleteCriticalSection EnterCriticalSection FindResourceW GetLastError GetModuleHandleW GetProcAddress GetProcessHeap GetStartupInfoA HeapAlloc HeapFree InitializeCriticalSection IsDBCSLeadByte LeaveCriticalSection LoadLibraryW LoadResource LockResource MultiByteToWideChar ReleaseMutex SetUnhandledExceptionFilter SizeofResource Sleep TlsGetValue VirtualProtect VirtualQuery WriteFile

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

memcpy strchr strstr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p__acmdln _cexit _configure_narrow_argv _crt_atexit _exit _initialize_narrow_environment _seh_filter_exe _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf fflush setvbuf

api-ms-win-crt-string-l1-1-0

strcpy_s strlen strncmp wcscat_s wcscpy_s wcslen

ole32

CoCreateInstance CoInitializeEx CoUninitialize

oleaut32

VariantInit

shell32

SHGetSpecialFolderPathW

user32

wsprintfW

Name

.text

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1024B

Virtual Size

840B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

580B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

136B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

xworm.exe

advapi32

kernel32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

ole32

oleaut32

shell32

user32

generic