xlite (1).zip
- SHA256 4f08741e0b84632cb29a67a8a0c16d5f797cfe422f792b0bce4f1d317b0e4f39
Password
12345
Static task
static1
1 signatures
General
- Target xlite (1).zip
- Size 701KB
- Sample260803-a3s8vsvfmc
- SHA256 4f08741e0b84632cb29a67a8a0c16d5f797cfe422f792b0bce4f1d317b0e4f39
- MD5 766915e1027a5eeb9ebe636a23409ec0
- SHA1 69e772790c151b0e6ba909b2ede60c8f2dfa9a94
- SHA512 72f74160035bc36d81cf4159402fc1ac971b24e48b1940d1a658906fabac58025bdb7fce4c8209841883002bfb3e021b970b32f07390f67017f1fd4f8b5e61de
- SSDEEP 12288:bq7B6usD9+46rKrway8vnG+th+hNndSHLb437p40NBiHATssj2FnQahjrRw8q1Fm:hp+x5OnG+tiNnQ/43940LDssqFnQSMFm
- TLSH T1C0E423CDD0729C640366E82AF845B9F386C0BB65D71959BDBFE4B2E20118230F05BE78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/XhangerCS2Lite.exe
File Explorer
-
xlite (1).zip.zip 701KB
-
XhangerCS2Lite.exe.exe 1.1MB
XhangerCS2Lite.exe
- IMPHASH a02d1a01e57c45f7af584da73e9fff85
- SHA256 58d63d63ba58859fbdcc888842856d054bdf551945c0d8d03dc9489d6df24c05
- MD5 3ed2c582c7310b2926ab8ddcb1fadd2f
- SHA1 20102cc731a607b572000cb9f9c093f0d6604790
- SHA512 50be358072412edce6f414255d10f38bbb74a2d4001064344fae8f2c5d0efa347ff9460930816af81b1b460e9620f518cf5d4faa42baf22e10d5fb3771aa07d9
- SSDEEP 24576:C4SCctUXaZ9EzOUoIyGfoJVNbjZO0R5P3rjD3gPH2EF1:CInXaZXHzGfmBOw3rjDZs
- TLSH T1DB35D003F3A2C33ACB17283186A6E762567FBC501B12918773A82959DFD31E04F9B6D5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
12345
Minor OS version
0
Major OS version
6
Entry point
209739
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
kernel32
QueryPerformanceFrequency
QueryPerformanceCounter
GetModuleFileNameA
lstrcatA
Sleep
GetFileAttributesA
CloseHandle
SetFileAttributesA
CreateProcessA
WriteConsoleW
HeapSize
CreateFileW
SetStdHandle
GlobalUnlock
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
GetFileAttributesExW
GlobalLock
GlobalFree
GlobalAlloc
CreateProcessW
GetExitCodeProcess
WaitForSingleObject
DeleteFileW
GetFileSizeEx
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
WideCharToMultiByte
LCMapStringEx
GetStringTypeW
GetCPInfo
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
RaiseException
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
ReadFile
GetModuleFileNameW
GetStdHandle
WriteFile
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetFileType
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
VirtualProtect
CompareStringW
LCMapStringW
GetLocaleInfoW
SetEndOfFile
user32
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
GetCursorPos
SetCursorPos
ReleaseCapture
GetClientRect
MessageBoxA
GetKeyState
LoadCursorA
ScreenToClient
GetCapture
ClientToScreen
IsChild
GetForegroundWindow
SetCapture
SetCursor
imm32
ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext
xinput1_3
ord4
ord2
urlmon
URLDownloadToFileA
wininet
InternetCloseHandle
InternetOpenA
InternetOpenUrlA
InternetReadFile
Name
.text
Size
361KB
Virtual Size
360KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
436KB
Virtual Size
436KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
313KB
Virtual Size
323KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=28, id=259, version=33140,
count=189, id=261, version=33140,
count=26, id=260, version=33140,
count=2, id=156, productName=VS2010 build 30319, version=30319,
count=24, id=259, version=35207,
count=19, id=260, version=35207,
count=82, id=261, version=35207,
count=10, id=257, version=33140,
count=147, id=1, productName=Unmarked objects,
count=3, id=257, version=24610,
count=8, id=265, version=35214,
count=1, id=255, version=35214,
count=1, id=151,
count=1, id=258, version=35214,