XWorm V6.0.zip
- SHA256 91f5ea61bd6f970209c8b08bc46532b2a7c2c29d9a4d4fa3496de74eb9d6a0fa
Overview
overview
10Static
static
10XWorm V6.0/NAudio.dll
windows10-ltsc_2021-x64
1XWorm V6.0...on.dll
windows10-ltsc_2021-x64
1XWorm V6.0...ws.dll
windows10-ltsc_2021-x64
1XWorm V6.0...at.dll
windows10-ltsc_2021-x64
1XWorm V6.0...um.dll
windows10-ltsc_2021-x64
1XWorm V6.0...rd.dll
windows10-ltsc_2021-x64
1XWorm V6.0...er.dll
windows10-ltsc_2021-x64
1XWorm V6.0...er.dll
windows10-ltsc_2021-x64
1XWorm V6.0...er.dll
windows10-ltsc_2021-x64
1XWorm V6.0...NC.dll
windows10-ltsc_2021-x64
1XWorm V6.0...ry.dll
windows10-ltsc_2021-x64
1XWorm V6.0...ps.dll
windows10-ltsc_2021-x64
1XWorm V6.0...ns.dll
windows10-ltsc_2021-x64
1XWorm V6.0...er.dll
windows10-ltsc_2021-x64
1XWorm V6.0...ps.dll
windows10-ltsc_2021-x64
1XWorm V6.0...ox.dll
windows10-ltsc_2021-x64
1XWorm V6.0...ne.dll
windows10-ltsc_2021-x64
1XWorm V6.0...ns.dll
windows10-ltsc_2021-x64
1XWorm V6.0...me.dll
windows10-ltsc_2021-x64
1XWorm V6.0...ce.dll
windows10-ltsc_2021-x64
1XWorm V6.0...er.dll
windows10-ltsc_2021-x64
1XWorm V6.0...ms.dll
windows10-ltsc_2021-x64
1XWorm V6.0...re.dll
windows10-ltsc_2021-x64
1XWorm V6.0...ry.dll
windows10-ltsc_2021-x64
1XWorm V6.0...it.dll
windows10-ltsc_2021-x64
1XWorm V6.0...op.dll
windows10-ltsc_2021-x64
1XWorm V6.0...xy.dll
windows10-ltsc_2021-x64
1XWorm V6.0...PE.dll
windows10-ltsc_2021-x64
1XWorm V6.0...er.dll
windows10-ltsc_2021-x64
1XWorm V6.0...ll.dll
windows10-ltsc_2021-x64
1XWorm V6.0...er.dll
windows10-ltsc_2021-x64
1XWorm V6.0...er.dll
windows10-ltsc_2021-x64
1Behavioral task
behavioral1
Sample
XWorm V6.0/NAudio.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
XWorm V6.0/Newtonsoft.Json.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
XWorm V6.0/Plugins/ActiveWindows.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
XWorm V6.0/Plugins/Chat.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
XWorm V6.0/Plugins/Chromium.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
XWorm V6.0/Plugins/Clipboard.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
XWorm V6.0/Plugins/FileManager.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
XWorm V6.0/Plugins/FilesSearcher.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
XWorm V6.0/Plugins/HBrowser.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
XWorm V6.0/Plugins/HVNC.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
XWorm V6.0/Plugins/HVNCMemory.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
XWorm V6.0/Plugins/HiddenApps.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
XWorm V6.0/Plugins/Informations.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
XWorm V6.0/Plugins/Keylogger.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
XWorm V6.0/Plugins/Maps.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
XWorm V6.0/Plugins/MessageBox.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
XWorm V6.0/Plugins/Microphone.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
XWorm V6.0/Plugins/Options.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
XWorm V6.0/Plugins/Pastime.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
XWorm V6.0/Plugins/Performance.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
XWorm V6.0/Plugins/ProcessManager.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
XWorm V6.0/Plugins/Programs.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
XWorm V6.0/Plugins/Ransomware.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
XWorm V6.0/Plugins/Recovery.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
XWorm V6.0/Plugins/Regedit.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
XWorm V6.0/Plugins/RemoteDesktop.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
XWorm V6.0/Plugins/ReverseProxy.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
XWorm V6.0/Plugins/RunPE.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
XWorm V6.0/Plugins/ServiceManager.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
XWorm V6.0/Plugins/Shell.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
XWorm V6.0/Plugins/StartupManager.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
XWorm V6.0/Plugins/Stealer.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
General
- Target XWorm V6.0.zip
- Size 41.9MB
- Sample260812-e7wl1aam2w
- SHA256 91f5ea61bd6f970209c8b08bc46532b2a7c2c29d9a4d4fa3496de74eb9d6a0fa
- MD5 08ab9dc85185d31aeee1b707bb4c113f
- SHA1 613f8b9bac6f351d31912f1bf16327f6b99dab3d
- SHA512 b280d8e68747c9f8e13fe0a31ba6dd96706a19b828489b53cca08d6ef1370d8c8827316a017c6e378f700acdec63394806e73844e0566ebdc27edaa72a2a7959
- SSDEEP 786432:+CegXmrCT0kw0P8nsyZ2WHTKK06k3e4SfWZc/Sy2Q2N/72+Mmz2b281lQDJpSj2f:rXmrCTvbPByZRTKK06OePnvw2+PydbQj
- TLSH T1A1A73389A59A04F9CEA8B2B397586C78DB498CFC671F482BE58F0754DD5B6C810C21CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: StormKitty
StormKitty is an open source info stealer written in C#.
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule static1/unpack001/XWorm V6.0/Plugins/Options.dll disable_win_def - StormKitty payload 1 IoCs
resource yara_rule static1/unpack001/XWorm V6.0/Plugins/Recovery.dll family_stormkitty - Unsigned PE 44 IoCs
Checks for missing Authenticode signature.
resource unpack001/XWorm V6.0/FastColoredTextBox.dll unpack001/XWorm V6.0/GMap.NET.Core.dll unpack001/XWorm V6.0/GMap.NET.WindowsForms.dll unpack001/XWorm V6.0/IconExtractor.dll unpack001/XWorm V6.0/Plugins/ActiveWindows.dll unpack001/XWorm V6.0/Plugins/Chat.dll unpack001/XWorm V6.0/Plugins/Chromium.dll unpack001/XWorm V6.0/Plugins/Clipboard.dll unpack001/XWorm V6.0/Plugins/FileManager.dll unpack001/XWorm V6.0/Plugins/FilesSearcher.dll unpack001/XWorm V6.0/Plugins/HBrowser.dll unpack001/XWorm V6.0/Plugins/HVNC.dll unpack001/XWorm V6.0/Plugins/HVNCMemory.dll unpack001/XWorm V6.0/Plugins/HiddenApps.dll unpack001/XWorm V6.0/Plugins/Informations.dll unpack001/XWorm V6.0/Plugins/Keylogger.dll unpack001/XWorm V6.0/Plugins/Maps.dll unpack001/XWorm V6.0/Plugins/MessageBox.dll unpack001/XWorm V6.0/Plugins/Microphone.dll unpack001/XWorm V6.0/Plugins/Options.dll unpack001/XWorm V6.0/Plugins/Pastime.dll unpack001/XWorm V6.0/Plugins/Performance.dll unpack001/XWorm V6.0/Plugins/ProcessManager.dll unpack001/XWorm V6.0/Plugins/Programs.dll unpack001/XWorm V6.0/Plugins/Ransomware.dll unpack001/XWorm V6.0/Plugins/Recovery.dll unpack001/XWorm V6.0/Plugins/Regedit.dll unpack001/XWorm V6.0/Plugins/RemoteDesktop.dll unpack001/XWorm V6.0/Plugins/ReverseProxy.dll unpack001/XWorm V6.0/Plugins/RunPE.dll unpack001/XWorm V6.0/Plugins/ServiceManager.dll unpack001/XWorm V6.0/Plugins/Shell.dll unpack001/XWorm V6.0/Plugins/StartupManager.dll unpack001/XWorm V6.0/Plugins/Stealer.dll unpack001/XWorm V6.0/Plugins/System.Management.Automation.dll unpack001/XWorm V6.0/Plugins/TCPConnections.dll unpack001/XWorm V6.0/Plugins/UACBypass.dll unpack001/XWorm V6.0/Plugins/VB.NET Compiler.dll unpack001/XWorm V6.0/Plugins/VoiceChat.dll unpack001/XWorm V6.0/Plugins/WSound.dll unpack001/XWorm V6.0/Plugins/WebCam.dll unpack001/XWorm V6.0/Plugins/WindowsUpdate.dll unpack001/XWorm V6.0/SimpleObfuscator.dll unpack001/XWorm V6.0/XWorm V6.0.exe - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/XWorm V6.0/Guna.UI2.dll
File Explorer
-
XWorm V6.0.zip.zip 41.9MB
-
XWorm V6.0/Background.png.png 924KB
-
XWorm V6.0/FastColoredTextBox.dll.dll 333KB
-
XWorm V6.0/Fixer V6.bat122B
-
XWorm V6.0/GMap.NET.Core.dll.dll 2.9MB
-
XWorm V6.0/GMap.NET.WindowsForms.dll.dll 147KB
-
XWorm V6.0/GeoIP.dat1.2MB
-
XWorm V6.0/Guna.UI2.dll.dll 1.9MB
-
XWorm V6.0/IconExtractor.dll.dll 10KB
-
XWorm V6.0/Icons/icon (1).ico97KB
-
XWorm V6.0/Icons/icon (10).ico115KB
-
XWorm V6.0/Icons/icon (11).ico9KB
-
XWorm V6.0/Icons/icon (12).ico9KB
-
XWorm V6.0/Icons/icon (13).ico361KB
-
XWorm V6.0/Icons/icon (14).ico361KB
-
XWorm V6.0/Icons/icon (15).ico361KB
-
XWorm V6.0/Icons/icon (16).ico97KB
-
XWorm V6.0/Icons/icon (17).ico66KB
-
XWorm V6.0/Icons/icon (2).ico112KB
-
XWorm V6.0/Icons/icon (3).ico131KB
-
XWorm V6.0/Icons/icon (4).ico125KB
-
XWorm V6.0/Icons/icon (5).ico100KB
-
XWorm V6.0/Icons/icon (6).ico106KB
-
XWorm V6.0/Icons/icon (7).ico164KB
-
XWorm V6.0/Icons/icon (8).ico108KB
-
XWorm V6.0/Icons/icon (9).ico264KB
-
XWorm V6.0/Logs/ErrorLogs.txt444B
-
XWorm V6.0/NAudio.dll.dll 502KB
-
XWorm V6.0/Newtonsoft.Json.dll.dll 695KB
-
XWorm V6.0/Newtonsoft.Json.xml.xml 696KB
-
XWorm V6.0/Plugins/ActiveWindows.dll.dll 1.6MB
-
XWorm V6.0/Plugins/Chat.dll.dll 1.6MB
-
XWorm V6.0/Plugins/Chromium.dll.dll 1.6MB
-
XWorm V6.0/Plugins/Clipboard.dll.dll 1.6MB
-
XWorm V6.0/Plugins/FileManager.dll.dll 2.3MB
-
XWorm V6.0/Plugins/FilesSearcher.dll.dll 2.1MB
-
XWorm V6.0/Plugins/HBrowser.dll.dll 1.6MB
-
XWorm V6.0/Plugins/HVNC.dll.dll 1.6MB
-
XWorm V6.0/Plugins/HVNCMemory.dll.dll 1.6MB
-
XWorm V6.0/Plugins/HiddenApps.dll.dll 1.6MB
-
XWorm V6.0/Plugins/Informations.dll.dll 1.6MB
-
XWorm V6.0/Plugins/Keylogger.dll.dll 1.6MB
-
XWorm V6.0/Plugins/Maps.dll.dll 1.6MB
-
XWorm V6.0/Plugins/MessageBox.dll.dll 1.6MB
-
XWorm V6.0/Plugins/Microphone.dll.dll 2.2MB
-
XWorm V6.0/Plugins/Options.dll.dll .ps1 1.6MB
-
XWorm V6.0/Plugins/Pastime.dll.dll 1.6MB
-
XWorm V6.0/Plugins/Performance.dll.dll 1.6MB
-
XWorm V6.0/Plugins/ProcessManager.dll.dll 1.6MB
-
XWorm V6.0/Plugins/Programs.dll.dll 1.6MB
-
XWorm V6.0/Plugins/Ransomware.dll.dll 1.6MB
-
XWorm V6.0/Plugins/Recovery.dll.dll 2.9MB
-
XWorm V6.0/Plugins/Regedit.dll.dll 1.6MB
-
XWorm V6.0/Plugins/RemoteDesktop.dll.dll 1.6MB
-
XWorm V6.0/Plugins/ReverseProxy.dll.dll 1.6MB
-
XWorm V6.0/Plugins/RunPE.dll.dll 1.5MB
-
XWorm V6.0/Plugins/ServiceManager.dll.dll 1.6MB
-
XWorm V6.0/Plugins/Shell.dll.dll 1.6MB
-
XWorm V6.0/Plugins/StartupManager.dll.dll 1.8MB
-
XWorm V6.0/Plugins/Stealer.dll.dll 6.0MB
-
XWorm V6.0/Plugins/System.Management.Automation.dll.dll 2.9MB
-
XWorm V6.0/Plugins/TCPConnections.dll.dll 1.6MB
-
XWorm V6.0/Plugins/UACBypass.dll.dll 1.5MB
-
XWorm V6.0/Plugins/VB.NET Compiler.dll.dll 1.6MB
-
XWorm V6.0/Plugins/VoiceChat.dll.dll 2.2MB
-
XWorm V6.0/Plugins/WSound.dll.dll 2.2MB
-
XWorm V6.0/Plugins/WebCam.dll.dll 1.7MB
-
XWorm V6.0/Plugins/WindowsUpdate.dll.dll 1.6MB
-
XWorm V6.0/SimpleObfuscator.dll.dll 1.4MB
-
XWorm V6.0/Sounds/Chat.wav45KB
-
XWorm V6.0/Sounds/Intro.wav238KB
-
XWorm V6.0/XWorm V6.0.exe.exe 11.9MB
XWorm V6.0/Background.png
- SHA256 2f691caff7e1980cfb069d2608b6470b3a06cdb90467ce47820e8602115a0c5b
- MD5 c93ee3abeff4ac24936471f80b36ec7a
- SHA1 0120649571a4b692ff5d10aae8dd87dffd3a0f81
- SHA512 dd319d1eea708284588ff67268cb23bd7b5cde505f3a8a1e7a27a587920ee5877efa4c1d8264cae48de343cabbf11bbe457b49f348b46288765eeff45d20cab5
- SSDEEP 24576:raWlRrTw9AK8jrGL+sUGBcD1MoEX1r/HXKIIfnbY:r/3w/8jzG+OomB/HXKa
- TLSH T1041523D6478670A5AECAC71881C71F777696DFA0AE64436DA6031BCCC3C0D525CE2BB8
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.0/FastColoredTextBox.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3701b19ccdac79b880b197756a972027e2ac609ebed36753bd989367ea4ef519
- MD5 b746707265772b362c0ba18d8d630061
- SHA1 4b185e5f68c00bef441adb737d0955646d4e569a
- SHA512 fd67f6c55940509e8060da53693cb5fbac574eb1e79d5bd8f9bbd43edbd05f68d5f73994798a0eed676d3e583e1c6cde608b54c03604b3818520fa18ad19aec8
- SSDEEP 6144:4FErOIif3RzSHh+20lXs1TzCeBcQeDbNlz7:eEeR52bmeh0n
- TLSH T1D274292422F84665E27F47BCD4B5A000D3FAB53699DFDB4E8B64A0DA2F63340D526633
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
346910
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Projects_CSharp\FastColoredTextBox\FastColoredTextBox\obj\Debug\FastColoredTextBox.pdb
mscoree
_CorDllMain
Name
.text
Size
331KB
Virtual Size
330KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Fixer V6.bat
- SHA256 a11703fd47d16020fa099a95bb4e46247d32cf8821dc1826e77a971cdd3c4c55
- MD5 2dabc46ce85aaff29f22cd74ec074f86
- SHA1 208ae3e48d67b94cc8be7bbfd9341d373fa8a730
- SHA512 6a50b525bc5d8eb008b1b0d704f9942f72f1413e65751e3de83d2e16ef3cf02ef171b9da3fff0d2d92a81daac7f61b379fcf7a393f46e914435f6261965a53b3
- TLSH T10DB02B177482E290838004430271224D39FDA002C291F2C375224530CD84CF0C333795
- MD5 SHA1 SHA512 TLSH
XWorm V6.0/GMap.NET.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 58c755fcfc65cddea561023d736e8991f0ad69da5e1378dea59e98c5db901b86
- MD5 819352ea9e832d24fc4cebb2757a462b
- SHA1 aba7e1b29bdcd0c5a307087b55c2ec0c7ca81f11
- SHA512 6a5b0e1553616ea29ec72c12072ae05bdd709468a173e8adbdfe391b072c001ecacb3dd879845f8d599c6152eca2530cdaa2c069b1f94294f778158eaaebe45a
- SSDEEP 49152:ot12Gb/hz7ZsK9qY5uyUW57VC4IB1+fXhQ1hyCzMw/22fSg7gjxhUE/nbTC0xemh:oLbteKb57W1+PhQ1HM1gmJ/SZmh
- TLSH T152D5234D77FC068BF5BFDBBD7870069A8331F106AA37E30E15A154A91D23B818851BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3002430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.9MB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/GMap.NET.WindowsForms.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365
- MD5 32a8742009ffdfd68b46fe8fd4794386
- SHA1 de18190d77ae094b03d357abfa4a465058cd54e3
- SHA512 22418d5e887a6022abe8a7cbb0b6917a7478d468d211eecd03a95b8fb6452fc59db5178573e25d5d449968ead26bb0b2bfbfada7043c9a7a1796baca5235a82b
- SSDEEP 3072:k1GmgYqIY/0YSDBRGlDUqL63budipxj64m8HWYh3vHbFwMhLJSb+:lIO6rGloqL63qW62lJ
- TLSH T1DCE3BF6173A58D2FD6BF4BBFA46240C1A371E603F602C38D6D8820ED2897F5587523A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
155790
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
144KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/GeoIP.dat
- SHA256 bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740
- MD5 8ef41798df108ce9bd41382c9721b1c9
- SHA1 1e6227635a12039f4d380531b032bf773f0e6de0
- SHA512 4c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b
- SSDEEP 24576:0L/59ah0USm3uwl00odi9AnW1fUmdbxv6bA3wOzRAc3InsZLONMrZb:+/59a6USdi9Ues6bV6boLO6rZ
- TLSH T10C457B47FF0A85DB5845B91EF9019EDC5810EE76BD0A1335226E37ACA0B8360ECD71A7
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.0/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef
- MD5 bcc0fe2b28edd2da651388f84599059b
- SHA1 44d7756708aafa08730ca9dbdc01091790940a4f
- SHA512 3bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8
- SSDEEP 24576:FIVZLRYIVQd9INo3FDbWX7SsOobBTEAjg+m+ZFNwaxwGoHQ/jzK+:+oWodbi9XFEAjg+m+ZFKaxw
- TLSH T1EE9508007ED0DB26D16B4E33D5E75010D3F2B4A26BB2E70F72D5A77C145378AA88A366
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
eb:22:ce:41:1a:e8:9c:9e:92:46:cc:c0:c9:06:fc:f3:4b:8d:c1:21
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sobatdata Software
Chains
Feb 21, 2023
CN=Sobatdata Software
Subject
CN=Sobatdata Software
Serial Number
7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:db
Issuer
CN=Sobatdata Root CA
Timespan
Oct 23, 2019 - Oct 22, 2025
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 21, 2022 - Nov 21, 2033
Minor OS version
0
Major OS version
4
Entry point
2031518
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/IconExtractor.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2
- MD5 640d8ffa779c6dd5252a262e440c66c0
- SHA1 3252d8a70a18d5d4e0cc84791d587dd12a394c2a
- SHA512 e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32
- SSDEEP 192:7f77J4cGYyfQknxLvIgyLY5xJeU5pPpZlEAs:HS2yINgyLYLJR5wl
- TLSH T179223809E7EA4B37DEB7873654134656E334BA10994FEF5B05CA50642CA73A00B12FBA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16170
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\HMJ\Desktop\IconExtractor-master\IconExtractor\obj\Release\IconExtractor.pdb
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
940B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Icons/icon (1).ico
- SHA256 115f0db669b624d0a7782a7cfaf6e7c17282d88de3a287855dbd6fe0f8551a8f
- MD5 4f409511e9f93f175cd18187379e94cb
- SHA1 598893866d60cd3a070279cc80fda49ee8c06c9b
- SHA512 0d1f50243a3959968174aa3fd8f1a163946e9f7e743cbb2c9ef2492073f20da97949bf7d02c229096b97482ff725c08406e2e9aa72c820489535758470cf604f
- SSDEEP 1536:RBrn6a7/Zu/M615kfNOfEK3EpQkGhD94TtcmeVQU71qiLSeznFkKeUqvllR/t6c1:RBz65/M6If+3Js+3JFkKeTn1
- TLSH T1DFA39283B511D2E1E5308A33E15BE9F10F227C5EEB5A281B7684FF173873151AE2791A
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.0/Icons/icon (10).ico
- SHA256 7a97547954aaad629b0563cc78bca75e3339e8408b70da2ed67fa73b4935d878
- MD5 ad1740cb3317527aa1acae6e7440311e
- SHA1 7a0f8669ed1950db65632b01c489ed4d9aba434e
- SHA512 eee7807b78d4dd27b51cee07a6567e0d022180e007e1241266f4c53f1192c389be97332fcd9f0b8fda50627b40b8cf53027872304a68a210f4d754aa0243b0c2
- SSDEEP 768:VDRRKECMsn3H2GkmPe3KUDlGEJ57ukb8rJXAtnvWrpLDvZ8EZN:tjls3WGkoe6Uso9T8r9AtnertLFN
- TLSH T1B9C31747A1281C21DBB0EE39A2DCC8BB594F5E79F1A6464C7CB5FC6864F68F1053AC06
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.0/Icons/icon (11).ico
- SHA256 3b64b79e4092251ebf090164cd2c4815390f34849bbd76fb51085b6a13301b6d
- MD5 1c2cea154deedc5a39daec2f1dadf991
- SHA1 6b130d79f314fa9e4015758dea5f331bbe1e8997
- SHA512 dceebc1e6fdfe67afebaef1aff11dd23eda6fae79eb6b222de16edebdfebd8e45de896e501608254fb041824080cb41c81ac972032638407efc6bfeb930bfd00
- SSDEEP 96:hc4i1w+DSf0RxO/Csg9nL2CupMqM4pSg36IfgT9A+QdwhFKQfkIvxIm3sW88H:qa+DSf0RxOQnLjoSg3hfG5/X8cOO88H
- TLSH T122123AC826B0CF07E6591B36C8B27FB5142D4DD0DAAA262B94CCFF4471A0FF87585994
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.0/Icons/icon (12).ico
- SHA256 84b48ca52dfcd7c74171cf291d2ef1247c3c7591a56b538083834d82857fee50
- MD5 4ea9ab789f5ae96766e3f64c8a4e2480
- SHA1 423cb762ce81fab3b2b4c9066fe6ea197d691770
- SHA512 f917059b6f85e4a25909a27cad38b1ef0659161c32df54860226ff3d858127d8da592ea9072ad41d5a9986dd8c04a37e9ad34e2251883a8c2f0933e6aa201414
- SSDEEP 192:8mEKEEjOjzSId77Fe0ggzSXlYtAMXa77gieRHw9S1IId:HUNdsgzS1EAEaHB8IId
- TLSH T13312C764B449D511C83A4139CC2BC9AD03250EF5C5340C1BA89AFF6736DBAC5131B56E
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.0/Icons/icon (13).ico
- SHA256 2e2f17b7dd15007192e7cbbd0019355f8be58068dc5042323123724b99ae4b44
- MD5 e6fec4185b607e01a938fa405e0a6c6c
- SHA1 565e72809586e46700b74931e490e2dc1e7e3db1
- SHA512 13daeb2bf124e573590359f18a1d962157dc635a88319c9ed1a2e8ccad6322fb081579e1e8fbe62ffe55c8286c2bc8acb251d572a4beb00641ad5009a380e513
- SSDEEP 384:AyIh9xb9bexqcmOg1/JuiiiiiilllllioiiiilllliiiiiuGxbu:9Ih9Z91hJy
- TLSH T1B674056F7E12B9BAC77856BF0810B18D59586C2696DCF103791FFB2CAC3DD076A09242
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.0/Icons/icon (14).ico
- SHA256 8fc693238afc49a8098dac1762bfae891e818bb84749c6eef5f1b0c6c8ffddb2
- MD5 0c24edec606abda7c6570b7dcf439298
- SHA1 4478a102892e5eb4bb1da8e9c62d17724965691a
- SHA512 f8de3ffb8f9fe1394b3626ae5616213d4612b43f0635fa9053d74ac6fe536657e796289487f245b8abff74f1de8368c0df8e56bf21f540366ed86a378649ea24
- SSDEEP 384:FY9tDXICTUj6Q+CUsn2JiAAA/////////A+AA////////AAAiA////kujYYFsG3I:+PMXT0
- TLSH T13574D45560B2F99CE512CAF714F0D5005DF2AC68AE6CA65EB9317FBE4E7708230867B0
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.0/Icons/icon (15).ico
- SHA256 b2f57a23ecc789c1bbf6037ac0825bf98babc7bf0c5d438af5e2767a27a79188
- MD5 e3143e8c70427a56dac73a808cba0c79
- SHA1 63556c7ad9e778d5bd9092f834b5cc751e419d16
- SHA512 74e0f4b55625df86a87b9315e4007be8e05bbecca4346a6ea06ef5b1528acb5a8bb636ef3e599a3820dbddcf69563a0a22e2c1062c965544fd75ec96fd9803fc
- SSDEEP 768:0nnnnnnnnnnnnnnnnnnnnnnnQInU2/gohN/yRUZZZZZZZZZZZaaa0KaaILjeuFgZ:Rkccckccccct
- TLSH T18E74051CB53AFC87E85A9E727E42E77588BE2C135F608841F604FFBE9639505A3D8811
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.0/Icons/icon (16).ico
- SHA256 3f3c5ce486e5b9fa88dc60b60916053e8808c69167df1a11287fd3cd6db1ca6e
- MD5 14465d8d0f4688a4366c3bf163ba0a17
- SHA1 9f1fa68a285db742e4834f7d670cae415ce6b3b6
- SHA512 01db4fac75136baf9c162265785877b21fba9c4b8d9dbe4e495191f15aa9c914e3d5baf1c4606041279a7138c7e5c8f4ccf6e64689354fc3fb3fa66ab3b1da2d
- SSDEEP 768:5As1Fd6jrW6QKysmsolxc4nvPQIfjRuw+mqbz9j1MWLQes2aXS5Cjr:5AMwflmsolaTIrRuw+mqbz9j1MWLQs2
- TLSH T15DA3D2F1A740C465D8A796B9883BDAA7A423A24DDC6C490D3D92FF0B7D723474027C9B
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.0/Icons/icon (17).ico
- SHA256 12f600b09c0db00877684a950fc14936ecc28df8f0ddc6821d68e4b82077ad92
- MD5 167425a3fa7114b1800aa903adc35b2a
- SHA1 601e8bd872ea31aff03721a0361e65a57b299cad
- SHA512 586ce1360eb06f1df8e95ad178abfae7c9d41cba1be55276b3d3947d0504ca09185e543b7dbf1ba72dde4942ff626859a6d2e8a1faaaf6c5daaebd8740dcf538
- SSDEEP 384:keGRHCUZYDikdQarfw8lGqMtxoYDQqrp0KR1QCOICdu2kkyPgE+zi/hScVsUIGVN:8fY/lVoTlR1vCU/he6H
- TLSH T10163C4D2F200C5A8FC398B75D53B4A7411137CBEDDB4A56F78887E2236B72A2402B957
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.0/Icons/icon (2).ico
- SHA256 142b529799268a753f5214265c53a26a7a6f8833b31640c90a69a4ff94cee5ec
- MD5 f1463f4e1a6ef6cc6e290d46830d2da1
- SHA1 bda0d74a53c3f7aaf0da0f375d0c1b5aca2a7aaf
- SHA512 0fa93d009cc2f007d19e6fdda7ebe44c7ed77f30b49a6ef65c319133c0570ab84f2d86e8282b5069d7f2e238547722ac3966d2fa2fae4504133f0001a0387ae2
- SSDEEP 1536:WE4NpLpq8Bb7RFRz8nqF+o2Hc0cccwccyccxcccMcccNmccdccccTccccncccNJ+:j4NpVq8BxFRzaqF+o2GQJ7/JzqVfGv2
- TLSH T186B30F6A8EEBB642C5425474797363814A3D1F78A4CE35518EF33FED5AF3CA521230A2
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.0/Icons/icon (3).ico
- SHA256 b2f7fb22cd5b935cf19a2f58f7fef9db99db40772ff4bb331a73c345161c2574
- MD5 a512719efc9e6ecc5e2375abceb1669a
- SHA1 51fae98edfab7cd6b6baac6df5ecbda082eeb1db
- SHA512 e0153dbc8f3fdda8d1a7082bc30a3895d7f4b3bc2982b4b4ece55653d1b4c293eba3ba6d4a0a581f0f7db95ab287d6616ef7bf03af4485904111798bf9d9e625
- SSDEEP 1536:Ms6se7llqn17KineXd2wwKtivEYoNRh8RX9EIKhI49NT:MsgbcUieNJHKoPC5+Ld
- TLSH T1C5D36CFF29A9491FC2052D78C249F735044EFD6278C6CA03B5A57E9FF23996A1C20993
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.0/Icons/icon (4).ico
- SHA256 5bb21d6c04ed64a1368dace8f44aff855860e69f235492a5dc8b642a9ea88e41
- MD5 9c053bef57c4a7b575a0726af0e26dae
- SHA1 47148d30bc9a6120a1d92617bf1f3e1ba6ca1a2c
- SHA512 482d639ba60f57827d8a343f807f4f914289c45643307efaa666b584a085fe01ac7892252f41b7756fde93d215b4f3fed16e608bc45102d320d77239fa93146a
- SSDEEP 1536:zVRUhw3TWxcZss+SP21wH7QOK/PPLr8zdYpizfgMRHGuTRLJHPxDsPsx3CXhRcVN:ZRUGKXs+S++7KFSbxeY+qDDrMY
- TLSH T1BAC32C2D5E4BB8DBE42449B558A6EBD10A6CEFA4F4E1169834E8FE3CB7D1474C500F90
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.0/Icons/icon (5).ico
- SHA256 45c85bdaaf0e0c30678d8d77e2585871ea6d1298ee0d30037745bacea6338484
- MD5 9dbdd6972e129d31568661a89c81d8f9
- SHA1 747399af62062598120214cef29761c367cfd28a
- SHA512 e52572de3f0d57d24a24d65eca4ff638890ccc9c5aca3f213ff885eda3c40de115849eb64c341f557d601f566ce21f8fc0df25cc4b13aaad5e941449a6b7f87d
- SSDEEP 192:sVLDqC6ot/2AlVx1qa6mgIwEk4w00wILxuudXCnadwyHXZ:EH/6A/9d1qDIwEk4w00wsuuXdwyHJ
- TLSH T112A379CB6E1486B7CB4CF63054A7B33C032BA83D6BD38E0EE55B3E59AB3265C9945105
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.0/Icons/icon (6).ico
- SHA256 6ea04cf08751a2f6bb2f0e994258a44d5183b6cdb1471a0ee285659eada045b5
- MD5 d7c9666d30936e29ce156a2e04807863
- SHA1 845e805d55156372232e0110e5dc80380e2cb1e5
- SHA512 3cfd7a41f65c5a0dc23a90c6af358179efb3ae771f50534c3d76c486fe2d432ea3128a46b4b367c4714e86e8c0862a7385bd80662fe6ea82d7048f453570ed56
- SSDEEP 768:LZe7enyslZ87gUcXmEHNBFNJC5jWb2NM2:Npysa7iAM2
- TLSH T1E1B3EEA41820C65DD5C4A776CD17B37D37882E5C14319B8A9270B8EEB23710D297EAFE
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.0/Icons/icon (7).ico
- SHA256 29d38c75af79aa0554f34cdfecb311f88f8dd02b02facaa299b9700841806ab8
- MD5 7891c91d1761dc8a8846d362e6e31869
- SHA1 0229bb01b7b4a0fca305eb521ec5dfbaa53674ea
- SHA512 ed14614a706da985566853dc13df0d1128a718f39ec9957320813803fe07e59de337d51033970e2f57d9f56da3546c506f5f0f3becfa91ce741576855be14ba7
- SSDEEP 3072:Y8SKfbzxcwg7es6/Vsb8VKTu549oJMfF/H9N3Ky9NzLn+:YUhcX7elbKTua9bfF/H9d9n+
- TLSH T1A6F3BF6D2E55CD46E9854C7544B7D3BCE66C4DB32E4C8912E72C7EA41B3AE483E22323
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.0/Icons/icon (8).ico
- SHA256 a65cbbdc2ca671a9edd7edac0c6737b3b116e357727e003e5fdeff163c6c21ab
- MD5 af1739a9b1a1bf72e7072ad9551c6eea
- SHA1 8da0a34c3a8040c4b7c67d7143c853c71b3d208d
- SHA512 eeeac307371c38b75e256083c55a3fe4ab096c1c7520a4b7acb40fad3af5a0d6c88aaf85f2c3e418034abee422c2a3ba13731adf7ee6078016da4dd2e989b120
- SSDEEP 768:ygjWAisCkoAbhMDB8dfO944J+IiIxzAILEhmtkW9iVHD:yOybBYfOS4J+1oEhyiHD
- TLSH T168B3A69A1D055BF7E70CF43480F3732D637ECE3A3E961E4DE9AE7EA862708491598811
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.0/Icons/icon (9).ico
- SHA256 bd1c33a67244801e828035904882ec53bd2ea8a1db9265a06d1aa08cf444ca80
- MD5 3e24e40b41ecc59750c9231d8f8da40b
- SHA1 91a701cf25aea2984f75846b6c83865d668ccad6
- SHA512 fe62edddb62dd4b695f1ef40ffb7a0119d480d1c176f0254acee19a45d6433ef6c308acbe567c721018390626c71f7a0f7bcd195d59d54c19cf019f13c4f7572
- SSDEEP 3072:HAZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ+ZZZZZZZZZZZZZZZZZZZZZZvZZZ+:H+GIIIIIIIhIIIIIIIIIIIIIIIUP
- TLSH T13344EE606A050EBCEFE0BA78EBDD536513A52E91017B54CF13D03F8A3537E53BA9A052
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.0/Logs/ErrorLogs.txt
- SHA256 743eb11360b0e033025f9de4a56ae0fd2d54286fb1492b568db0ed98c8f6f994
- MD5 96fbc4c54b244276503ca8914a758a3c
- SHA1 5752549a38d68710eb0aaf6ca76b51e3bd0fd2b1
- SHA512 fceb65b49d045982eb21f48dacddb9c7a23d77988a8c4282c6cf2a42474f32c84971bad1037b369a8dbd9729add58dfc9da10b932b426b4c4a384523586edc28
- TLSH T1B0F02E3C04A49035B117A66873685970823D603E51D786992D7FA21837C6E36C13E93D
- MD5 SHA1 SHA512 TLSH
XWorm V6.0/NAudio.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451
- MD5 3b87d1363a45ce9368e9baec32c69466
- SHA1 70a9f4df01d17060ec17df9528fca7026cc42935
- SHA512 1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7
- SSDEEP 6144:96/i10SZtfzWctj98vZcE0wmLlaIZs5eku2sX2hrjAzvgmXa6W9FwsT9idwktQZG:9yrSKMJR9aGs55T1X9Fwspi2tGpmS
- TLSH T156B45C2237E4962BD1AF5775E4E1191B8BB1F8423237D78F8684BB6E1D837924C407A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d0:94:af:d7:9f:51:16:9c:c5:1a:e7:ea:23:e5:08:16:11:ae:03:76:1d:25:05:ee:5f:c2:9d:59:4a:68:c8:54
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
Chains
Jun 3, 2020
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
Serial Number
37:37:aa:de:9f:72:21:81:eb:6e:a4:00:21:65:fb:e1
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 22, 2019 - Feb 27, 2022
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Minor OS version
0
Major OS version
4
Entry point
510758
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\code\GitHub\NAudio\NAudio\obj\Release\NAudio.pdb
mscoree
_CorDllMain
Name
.text
Size
494KB
Virtual Size
493KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- TLSH T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Mar 8, 2023
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Subject
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Serial Number
06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 15, 2021 - Jan 14, 2046
Subject
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Serial Number
0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 15, 2021 - Jul 14, 2031
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29
Issuer
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 13, 2021 - Oct 29, 2024
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
704578
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
681KB
Virtual Size
680KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Newtonsoft.Json.xml
- SHA256 79ee87d4ede8783461de05b93379d576f6e8575d4ab49359f15897a854b643c4
- MD5 d398ffe9fdac6a53a8d8bb26f29bbb3c
- SHA1 bffceebb85ca40809e8bcf5941571858e0e0cb31
- SHA512 7db8aac5ff9b7a202a00d8acebce85df14a7af76b72480921c96b6e01707416596721afa1fa1a9a0563bf528df3436155abc15687b1fee282f30ddcc0ddb9db7
- SSDEEP 6144:XqqU+k/Rik5aG0rH3jGHdl0/IdHXpgVIeR0R+CRFo9TA82m5Kj+sJjoqoyO185QA:DU1
- TLSH T155E4E02577C4CB220C7A012A4D1CF0C5FF205AB316192CA635CC5DDB9F7AEA252FB6A5
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.0/Plugins/ActiveWindows.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5d7d2f09b0f9e274f64ee35d4fd986668bb9cb938cf6c44253634e284fc0e921
- MD5 e3c0e4bec40771d80bb3e3932fa88ba7
- SHA1 6ba82ab518dbd7ad6588c5b64965e741f40fcc5b
- SHA512 ea473e2de9aa3818d5e37d4c5b6ada48e74128cd66f2235c2143d1dee67c17aef4e7b93d2719f930bd9163262bf59a5643973476dc2343e15734f32452a13483
- SSDEEP 24576:lCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlf:c7uRfbQswUZcSByYGv5u
- TLSH T17A759F62B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1632814
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Plugins/Chat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7c64c646d22f95d109e9832c7245d38a1484bdca1ddf14b544e6555448cdd513
- MD5 6a06c28ead10e020f4dafac0423fd9cd
- SHA1 eb11db4d8820b80ca0f83d8fe011399abdaf8180
- SHA512 a1ba0ce614b41b629815b8db8974ee14c9cf6c4a930b02ec3bdb38fee05f05788c0d671d120f685259ce743b6c2d5e02eb9051f9d07381775b0ab9cf71bcfc34
- SSDEEP 24576:ICs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlf:T7uRfbQswUZcSByYGv5u
- TLSH T122759F62B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1638094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Plugins/Chromium.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2b2dfd13b40c5a7dd3754d43f07410052b3894fb80d75a7e7fecf2cb5300b90b
- MD5 79bf02ce63e67e0a9f6a8934bf6f343a
- SHA1 a25e2270ee4a3fd599c04ca9e34c2e46c3a04656
- SHA512 d03dd276f78fa57e8400c58c39c72c49c959920a152b8c8673b771c5947698df0cb36a3313dba162935bb66d4ae78fbeef85ef11cfce36cfc459c0bbd70dd75a
- SSDEEP 24576:HCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlfC:i7uRfbQswUZcSByYGv5u
- TLSH T1F875AF62B69AC1BAD4ED80B9897B961EF7B6784407348BDB12D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1659198
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Plugins/Clipboard.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 04b560b045ce83e4ecc6d052080d4263e590cf67409a38f31f6bbd7324dadb8b
- MD5 aef1b7f2665da23fa6449036ba64fe33
- SHA1 ebc4088171e554b0368155501d3c3d2f4b4c3ab6
- SHA512 a635cf53e870f1eba44ca2fc111a6d951b5b0e2d1641b0486b580dcea04f461e9faf77c63e4c6092d4636a0db3c7d8a1563e1fc6cf3128eaec0ec1d172b77b94
- SSDEEP 24576:jCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlf:u7uRfbQswUZcSByYGv5u
- TLSH T120759F62B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1632334
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Plugins/FileManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 15d73e99263c2c88731cbb4b915f6de55dde33d06556fb75b5f41adde7fd3134
- MD5 c176399595eb243d5acdcf35a80f5d81
- SHA1 be9d1d8a1bdc3c3cef42aecce77947fc3a6f5737
- SHA512 3f21a8d4a63853370a0e47e8a91d697a1ff96219babb226cdf66cad3e6728a06a40fca7ff50c12678eab7896d9da3dbc17f1dab3ab42d6374933b1b43e81f5e9
- SSDEEP 24576:B0UvjCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlfjLy8Vbh7MGWM33:Bdvu7uRfbQswUZcSByYGv5uRy8V7ICa
- TLSH T1BCB5AE2277AAC17FE0BE41B5947A862AE7B274410761DFCF12D4167D1EA33E01E39326
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2445998
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Plugins/FilesSearcher.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5b2e35024b7d1f7369d0ff09a6d765958f8a8a37fa5016e95874943430269dd6
- MD5 ce7e4278984ab5aae85023aa7052fd0a
- SHA1 d6771d70b6b5e97f0d313ca9c3dc7c19734dc584
- SHA512 1beda73bbccb2ce9b0f8d99f35c8e3ba325d982cae82357d5efebf7e8e16fb206922a9c1ea78a4cd07d95ce0d61ab3cf6d8fcb97332bc7d592cc47a2b7a5bcdc
- SSDEEP 49152:EL5R4mjF7uRfbQswUZcSByYGv5u7NX1+q:EL5Sm57ul5ZNl
- TLSH T19FA5BF22B6D9C1BAD0FE42B984BB955AE7B178440B38CBDB12D4166E1E337D05E39313
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2223214
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Plugins/HBrowser.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f3a1ddea6cce676bfa3f0bd2507fff9c34764879862be3d0d944b8c07d0f09c4
- MD5 b922fb5a11ce558131809f9953acc166
- SHA1 ecff9c78fe454b443640e6bab2fed5d7b35957b1
- SHA512 fe408fddd4049e352d4e3b33d074b0ddf9f39f02b6da5cdf7f5c8f8285287a06f74c94cc99973beb62abc36f69f61ca558b06ba5450f9f0a5d594ee20b71342a
- SSDEEP 24576:yCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlf:57uRfbQswUZcSByYGv5u
- TLSH T103759F62B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1650142
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Plugins/HVNC.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 51e642ccb7d17770ee4c34077f95f4b15108bfa6380ef2e1caa3ff80b49721d3
- MD5 1369a5fd749e7a51d100bd1085c66a5b
- SHA1 485c22638cf0bdc51a67ad449ad2e8d2a94722d1
- SHA512 ceb35de42fbde0f34f0a2d32a792b890c1000f0b4d2089ef5fc568d02fd38eb723665ae18c210e600b5f1a191b117d8b75a568c5091c899b46769e540b445db8
- SSDEEP 24576:rCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlfv:m7uRfbQswUZcSByYGv5uF
- TLSH T16D759F62B69AC1B9D4EE80B9897B961EF7B6784407348BDB12D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1677150
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Plugins/HVNCMemory.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c51a6c2aae865c8e7ca285b8403237b1975738a22c89e6a91d388535ae21823c
- MD5 d54ca2b00cfdd43647886433ddf78f9b
- SHA1 be70d01429652eaac90616bd096e976158e0d2f7
- SHA512 486ad36b1ef32b40b7c8aee89e0aaa00a71dc8cd054733ccec64bc5bdb57c3826a1063ea8a13a4ee3fa9b11a4266b52d8daa3f354aed08330aeaca2cddb539fd
- SSDEEP 24576:zCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlfCK1K:e7uRfbQswUZcSByYGv5u
- TLSH T119759F62B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1669470
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Plugins/HiddenApps.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1cc5ed0227aff0a8066c2a34ab08e3e1605910ab87d48538efd0e3d7bcf8cb49
- MD5 01a90b36d48786a321983f09d350d163
- SHA1 44eddb6bd9a1312edd560aaf4a59caf62a613765
- SHA512 6cf35bd7f0edd34db5dc1a90add61ee5527a99f0ccff8c146cbe1160cb71bab0e30e11c90f029870c75c128014db6963e4a8820035c009e809b2614ef705c999
- SSDEEP 24576:MrCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlfsxY:17uRfbQswUZcSByYGv5uy
- TLSH T134759062B69AC1BAD4EE40B9897B961EF7B6784407348BDB12D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1676942
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Plugins/Informations.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 170281e79fcdfaab997e001c43b40b0c263074d3470be4dd355a7c9a5a187c8c
- MD5 f023b857d9f5d127a9f6e8a1557aa6a9
- SHA1 da15b624c95b5263334b2f1b2c2c5db258ac125a
- SHA512 dcabed2dc5835706ad5358d564ce3a566e9ea1baab15a43816e41366c9cbdd771ee27d733148f587afab26e1f19d6248dbc8c6e21f7367fd4f0bbe497aed0c8b
- SSDEEP 24576:ZCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlf:w7uRfbQswUZcSByYGv5u
- TLSH T1FB759F62B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1645150
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Plugins/Keylogger.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9389ca12e6f0d9657ae4193d038c8dea8717f171340f56c3b1c078cfe4f3b290
- MD5 9eb8553f45e2aa12d296231a669e3793
- SHA1 8161c51a75456fddb71dbc431db3a4d307618df4
- SHA512 5f6b34ea6bc6a8a223aaca14cbe97c513984fd9b7b657d45d60b6991ea2a48a09082c085b930cd99df1d8497117a486efe3d475de05c3a401a3b28884bf708ab
- SSDEEP 24576:SCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlfs:Z7uRfbQswUZcSByYGv5u
- TLSH T195759F62B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1636782
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Plugins/Maps.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9368027ce3cbe90de668959b5adae236d0c9d75edc6d3cd2b69523bfee7a532e
- MD5 a7384453e5e7897c2e751997f2c4bf4c
- SHA1 4fb8777a6aafd32662381f213ced42adddcfe258
- SHA512 d84b16bde3b847ff2c3ef198734e0c1789abfcf31438178b758e4e02899bfa219152840cc4100090c056d1558028e6f0f0acbd01d9ba4a7714f02b7abe5b51f7
- SSDEEP 24576:zbCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlfQmB:z27uRfbQswUZcSByYGv5u5
- TLSH T15C759F62B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1634430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Plugins/MessageBox.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c2ad37a82c90777e2038bd75a985bf06b597f13ccd519c0f5bc5f0fa6ab7f268
- MD5 e1982ca1368b579865176523fdb08c94
- SHA1 170641b991682ffcf01f8e578dc29cdaaedae952
- SHA512 53d0b39629c9fc67ea848b7948e459f04ef0c0ad9d5d2022d8eed3e9dabeec56776f5eae4381bce07d03049561da0de30d051487bb628978d676755141558c88
- SSDEEP 24576:cCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlf:H7uRfbQswUZcSByYGv5u
- TLSH T151759F62B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1633582
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Plugins/Microphone.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d63f9823b3fe95f6f25b820e6ea00e7d7bfb6ff4d9c511533a3ec5f26045eb47
- MD5 b0297d35e8cba02dc33277333f06a2fc
- SHA1 05af6c0f34a819932c0d14a18c04f7779ca7f5e4
- SHA512 9a00cacc0594f988726d3b51ea230bf28a8e96777af8ea5797399de86518c509cfcbe46070c9fa67372b801bcdd29af2888628b0e77733da8d027532595ca21d
- SSDEEP 49152:67NZ7uRfbQswUZcSByYGv5uJyu0eegkq:67NZ7ul5DyQ
- TLSH T181B5BE2277E9D1BBD0BE41B588B64A1AE7B2B48527348BCB12D4176E1E737D01D38363
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2277486
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.2MB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Plugins/Options.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5838c03713eb20b218c93c02bb955386192ba9d11b1028f704613c18032d93f0
- MD5 a88b091ca4175c76474281d286c14724
- SHA1 506b77ad660e1d11a2887bfa5d8422d6feeccc55
- SHA512 ed1a7486ffcf10f11e49f3f79d070d1a0614c674c12bca7fec8a0534254d57c5db531129212af556aa287953047ec6e96bf7be4c9d9e31dda2d183b2b5da5970
- SSDEEP 24576:5Cs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlf:Q7uRfbQswUZcSByYGv5u
- TLSH T1B5759F62B6DAC1BAD4EE80B9897B951EF6B6784407348BDB12D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1651678
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Plugins/Pastime.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 08e37d1bfc11b44dd49158f3f4bc747f541c6cb91e8dfe27091c1733d4ed0585
- MD5 8db73fd9c69d936457fb7559e92e6dcb
- SHA1 f5f013ec843b24f7a7379478957646bc93c015d1
- SHA512 caf78c2385eae6d9ed0eda6d5b71bdfcefe83b4e02767af61cb208c256eac8e3cb2498912ff07285bb104148f60c4870e87b48fb137c8551f98a42b5ff0de7b4
- SSDEEP 24576:fCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlf:q7uRfbQswUZcSByYGv5u
- TLSH T1DA759F62B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1637598
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Plugins/Performance.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 32578fd3fa29cab2a453866f89d695f66730b56dcef6c2e8af0ac048cf6f4870
- MD5 4baf06e6a9b1b46a64941e9cd2c7ef9f
- SHA1 86fce9edcc0d35a44b094c3517598b785dd6d686
- SHA512 694666de58769a0f8ece3f5f50e7bd6378adeacf92c0b12be8d2935da02b7a0a01f8b4dc883de140bbaf226bffdf118042ba55042c141143aee44ecbf696bce6
- SSDEEP 24576:rCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlf8:m7uRfbQswUZcSByYGv5u
- TLSH T1B6759F62B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1635518
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Plugins/ProcessManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 09b6033a47eb400afdc8c6fa109c23d9b39e2a0358ccc3b58bdfec2c1e6a8f8a
- MD5 47f44d6ffa9c528931f06a31b4ee58bb
- SHA1 f1b0fe18a2c63a172a6af758813d15d28d3deef8
- SHA512 e008b65d5dfe084142cea4c2a7d4998cd414aeb735932b2fb32e19a83bf4e3c0897e286cd36ed9d01cbf6788b13b92aaae9dc86303fd3b693f7aa2b351f83358
- SSDEEP 24576:UCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlf:v7uRfbQswUZcSByYGv5u
- TLSH T1EA759F62B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1639438
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Plugins/Programs.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8b17fe8a45c6133290610ea623dde9ef38ebc7ebb2b6b43a50dc6bfe6ce4c8b4
- MD5 e43679d9acf9a704b14983926aef61a7
- SHA1 77ea6253469936e161cee948277285ea38bf93d3
- SHA512 d3e2322248302f3a5f20e8bac642da856d098dbfe38344c44a9d64c51e3cbe218709f2db009a49ffef19470d22be53013c8371a381f2ae3cd39c8e757be83d4f
- SSDEEP 24576:YCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlf:D7uRfbQswUZcSByYGv5u
- TLSH T131759F62B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1631870
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Plugins/Ransomware.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 64cbbbf90fe84eda1a8c2f41a4d37b1d60610e7136a02472a72c28b6acadc2fc
- MD5 c1dac1c03efe11a63fb986343e2707a5
- SHA1 f779aef8c46bccdb593ba1567b57aa1fdd30f202
- SHA512 8fc5bd687ff5bd51d048f4450363f8c45ee015b7889071c28d681fd67a58cd1b65c0afe02afb60c2fae6d9ee158cd9a71790f247e4096335fc833583c238f6f8
- SSDEEP 24576:dCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlf:k7uRfbQswUZcSByYGv5u
- TLSH T1E0759F62B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1636286
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Plugins/Recovery.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 615f22a3851c0d4b8f0fcd905398ff89b482e52efc6c51e0455688ed5bbbab34
- MD5 6b413da4300296c3b0168bb88f6db661
- SHA1 3180c77841f9ab9ceb6e059a06338a4ad0dcc8e2
- SHA512 b1128ada4eb703c697bfaf7fb6a9962505ae2d61ae33dae739461a8ae1bc9252dd1063f7a3b31a18bf0845633be757db095a69e017ec2ec37dec50d3c762abab
- SSDEEP 49152:ZLe17uRfbQswUZcSByYGv5uq48vmy7cBLjchSO:w17ul5+
- TLSH T109E5AD117BD8C26BE0BE82B5A4B245199BB1F8456735CBCF66C0566E1E237C02E39337
- MD5 SHA1 SHA512 SSDEEP TLSH
-
StormKitty payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3083374
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.9MB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Plugins/Regedit.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d20a4862029cffc324488be99924fba6c916710bd9f4b4468533f45d8410b701
- MD5 71ed5e9271077a6a8c7b3d96fecdccee
- SHA1 5665a6086b920272cdcc37b9e09d6afd43c8e729
- SHA512 bb2226aef1335d3a85101fe764fa15089a20fc0e9f23011364182a3b21610d27929960ecd903958e703b7da51c9f4f11cb55fa4009fc01b97a3a02adc0f98760
- SSDEEP 24576:ACs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlf:77uRfbQswUZcSByYGv5u
- TLSH T1D0759F62B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1635166
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Plugins/RemoteDesktop.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 725972dcea27688f90f5a82ea2a20da7e12362a87b45fbadf3edae7c3ad005c6
- MD5 c2748822421c95ce8e7aaa4069cf2a0b
- SHA1 3f12aeac25f345f3b65cedf5a1bd40bfaeec2ca7
- SHA512 c6470f46d2ff39f01fdf9455d028177dceda3b4f818e72222eea8dd64dcf0cacd61db00a2d288f8de74633da639f53147b89ef997f17ae4d1985cc64b6836939
- SSDEEP 24576:xCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlf:Y7uRfbQswUZcSByYGv5u
- TLSH T117759F62B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1638942
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Plugins/ReverseProxy.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 64137b46ebc02e907353d394029a0ce2365c6202392ab4bf6e6274e633aff31f
- MD5 13861fe3b9f0691618cf12163f80dabc
- SHA1 f944ea3f83b7027d56d6e3b0a073e4a94ea0ab6e
- SHA512 a22af148cf702556b1d33f56b82f3480070fe5b657b0181c0b9ed78350daec880ea9df1075bd8c7cdc7147bbcb2ded8f33bf38492c3f477d41f3222b0c7ba12d
- SSDEEP 24576:ECs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlf:/7uRfbQswUZcSByYGv5u
- TLSH T1E5759F62B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1637214
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Plugins/RunPE.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c081c8ad969f547ecde90e67f3d92e6e16da585c044dc81a54c47fdb643c2e01
- MD5 e9c4b8bee8779787caed03f0aa5ba9f9
- SHA1 3202671a8da094b0be188ccac2dd4c119cb2beeb
- SHA512 40eceb74e1e889e5818f86b2771b74e087396c618241349fa6bcb08e10f1dfba5399f9cd72facadafd07532014f1d8f40e7c7c1dd856638e8e1c982d6a3b310d
- SSDEEP 24576:/Cs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlfx:K7uRfbQswUZcSByYGv5uL
- TLSH T180759F62B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1627790
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Plugins/ServiceManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c6b60477696aa9e3d01bd19ffe3bbe673135b75d56d9813746314091a196dee2
- MD5 ad46bff37c9b7d89eeeb89332aaf410b
- SHA1 6d0fd1cdbc3b7485044d08dbebfc78185f6b0877
- SHA512 1d953c4748170f785c895cec62e2e9371b81db281bdb4d1031438fc98fe3151be27dde806441fa80b7660f75e8e5cd583a3a40950c4d1f7ea8870bf762293ceb
- SSDEEP 24576:JCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlf4:A7uRfbQswUZcSByYGv5u
- TLSH T108759F62B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1633358
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.6MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Plugins/Shell.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 36b119e5e622d60ab96fed0bc524b34e9e3c9c4a3a15cfc79df259b4b2a15c62
- MD5 3c6e4bcd216e43be0ea3b7658a73b912
- SHA1 e74ae8186b37c13775a23c73c6d0cc6e97285810
- SHA512 1f968b7f944f95664acee13502144567d0b343d2bb66f4c0868f1679c718dd73d79dcb89794e67ef005985908cc75a9aef10c167070e8ef2ce950b32f427d6dd
- SSDEEP 24576:NVCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlf:Ns7uRfbQswUZcSByYGv5u
- TLSH T191759F62B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1633246
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Plugins/StartupManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3cbbd4f935e400fa512e2ccddb99c55d50b04ac3a030c5e5e1d583dc7f0b98d3
- MD5 ec5ca764dd85c64165d08a13c0fb1ec4
- SHA1 5f0012ff4ea3e3fcde608642631830b036e00c5a
- SHA512 85b1f86f3b5f209106e2e0b282b1cb74c3834203d747391c7837f868c2b0a9f80f66df231d80d8841ab611ebcf36869fa6e18c7e13d9239484d75c05f08bbee1
- SSDEEP 24576:FCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlfDp6X3Re:87uRfbQswUZcSByYGv5uZExe
- TLSH T1C885AF22B6D9C1BAD4EE81B9887A961AF7B674440734CBDB22D4176E1F337D01E39312
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1850062
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.8MB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Plugins/Stealer.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 dac881acf0bf22a933e628b3d1724e40d6eb26e575eaeaba6cf195dab1d5585e
- MD5 a96df5083e0f1a75b274d05460d274cb
- SHA1 c7fc0eefaecf0aad40b3fe43b013566b11d57938
- SHA512 8892b394df7dffd4f485a6cfad292741ce4e0aadc5193f68e0bf18f95e09f5eaac30abc7feec6f29bcd839a21519beb8911918fff9dc291b67f0556415468249
- SSDEEP 49152:R1b9RVSf+nCGWMqkAf/7uRfbQswUZcSByYGv5uH7FFHxUZ2MZsibvK8UzbP/c+3J:R14kg/7ul59J89siII2
- TLSH T14C56AD0477E99E27E0AEE37684B04526ABF0F419B322D7DB658067AE1C137C05D2637B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6264046
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
6.0MB
Virtual Size
6.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Plugins/System.Management.Automation.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9ac3217b73c9a7fe926572f0f9816b5eac3527421fcbf0350855b17c1e854c5d
- MD5 4214698ad147ea8e83cc0e7dcf883db3
- SHA1 8362a128ce9965a3f0c1d2a89631c6fba7b9dc3b
- SHA512 4bd679032d486d6a71ea3ded6e448926bd4b59b16e0f1f02e1d9efda020e1fa68fbf9fec92271b917ccd9f0d61294f1e53c430b33e75ffc76ca182f083627c45
- SSDEEP 24576:HO2WmZTqz8w3VCSOllassgrzV+SPQg6NfNaJe2yXtLZxrd3sZAURMpbr+q0Rxg/d:HSCSc1rzMSTJkXtGY1iq0Rxg/pO
- TLSH T15FD5D401B3EE0E5AE5BB4B7AA4B9011146F7FC166B33D74F5548A0AA1EB3740CD523A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2681886
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Management.Automation.pdb
mscoree
_CorDllMain
Name
.text
Size
2.6MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
320KB
Virtual Size
316KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Plugins/TCPConnections.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f3b6b8b4d8755a0a5526ac13440253f0a7d6ec3f726b3e1b22ce23da62fc2882
- MD5 bd3d1cdb02290b2a30d1d791191016cf
- SHA1 1d7070abc710eb62739a364826f6715d05bc8c31
- SHA512 32c42cb6bf67c698bcbb3d4ab53b1ca2541e182dbbc19de6ce59d6a1556a839c92a68cdce91d158dc038f37e6a6d1e324b9916250f0fed09f6cb4d07b7877804
- SSDEEP 24576:bCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlf:27uRfbQswUZcSByYGv5u
- TLSH T1FF759F62B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1635310
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Plugins/UACBypass.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5348d8231ad3ac512700289c2f8bc69eedf99a5d43cd2d8e263d1119168eb3f9
- MD5 caec1cf45a3a19c65f0ba30c2bc52404
- SHA1 080238eb9e9d9921b67ade078263e9c7aab83118
- SHA512 ddc5e823d949f9001b83672174e403fc02401bfbfe3dbd948036c1f2500ea03bf432e954a1d40fc3b963f8a2f005c9397043cbbff85d5f1cdf4b65c2b873a272
- SSDEEP 24576:yCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlf:57uRfbQswUZcSByYGv5u
- TLSH T1DB759F62B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1625902
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Plugins/VB.NET Compiler.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c76ce30f344af884f2dbbaf35efe77c26e82a0d59fa3ce69d3ddf6e52d701432
- MD5 99b2b728982ffed4c31103a31ee5374f
- SHA1 b1d45d705d8e1a5e18c8b7d98077d885976e99c6
- SHA512 5d0ab242f19b34c27026e5973a7dc33452e442bb5bdddcf0e209a684d8260110c9cd5f904af05f8912fe166615ceb3132a3573a552fb6f9d11602bb401aab315
- SSDEEP 24576:mCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlfh:d7uRfbQswUZcSByYGv5u3
- TLSH T1F6759F62B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1633278
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.6MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Plugins/VoiceChat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 295525d8e249b712c4b8d6755c1f60d91030be1c995757022fe242773c93c1d9
- MD5 14b59e3bd456fabeafac1e20c4032381
- SHA1 cf3453987f32c80fd54073ccca356cab1ecb2868
- SHA512 4999d94148dfc67745f3fd73f4f355336af679d349d4703f6f4c81b3c592fc3488de4bda338455d3a3cff79f196d54e31a7afd8e7ba2b017a1d4368ed75cd614
- SSDEEP 49152:uUUHF+RX7uRfbQswUZcSByYGv5uZseFZFD:uUUHFGX7ul5Ds0
- TLSH T1D6B5AE2277D9C17BD4AE51B688BA491AE7B2B8452734CBCB12D4176E1E737D01E38323
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2275678
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.2MB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Plugins/WSound.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0d8b30a7af95bfb8cdbeca1eec1822ca4c4f3023d16f752d68e49570e81b647b
- MD5 0509148057b21d3ce6559b7c33aefc11
- SHA1 adc70d94593cd031ce32cc0a69c580574911cb6a
- SHA512 0b9fbaf83504ec906354288269386f09e23e2763e7b9278446d88a1955f651332d52a25b31e1703b671994b0c733a1f074d517155e842ffd6b22ed0bbf7e1c41
- SSDEEP 49152:NzCD7uRfbQswUZcSByYGv5uslbXOzRpgu6:NzCD7ul5ylbXb
- TLSH T14AB5BF227799D17BD0BE41B588F6491AE7B2B88527359BCB12D4176D1E33BE01E38323
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2276638
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.2MB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Plugins/WebCam.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2cb3eeb59bc005298f43dd9d727b391fc789deac1efbb7df933a3931276c5c92
- MD5 393115e846697409ebcd7d93764f1074
- SHA1 8b7aeb4b2bfefd7f30993befd4dd3e13e20ab425
- SHA512 b394457c5d98bfca313d80c8e4cbdbb384938127ca593aa5ff6bd99d9765424dc18283cbcce856ab84e6c21d6ab02e285bd26c8c9599d1fbb92860ffd5a53823
- SSDEEP 24576:xMipHZtnCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlf:xDpHZI7uRfbQswUZcSByYGv5u
- TLSH T147859F62B6DAC1BAD4EE40B9897B961EE7B678440B348BDB12D4172E1F337D01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1834750
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Plugins/WindowsUpdate.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8c9ef55cc96357ec533bb639d4b928b19c4f1b3259a387989f041c4231b1fa8e
- MD5 8ded1f5ec0fde928509a4dc014ccc1f1
- SHA1 d368e70a98931b7764f6f84b8e7f28ff905d275f
- SHA512 13a1c20347e4af8d0ef09ac5cd35ae52851856bd403c852b270cfda19d278780c7743387f0800733b496e0ce6c7aade337460f4716ee4666400e3a477febbf93
- SSDEEP 24576:QCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlf:r7uRfbQswUZcSByYGv5u
- TLSH T19385AF22B69AC1B9D4EE80B9C97B951EE7B2784407349BDB12D4176E1F337D01E3A312
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1727374
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/SimpleObfuscator.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b7a6eea19188b987dad97b32d774107e9a1beb4f461a654a00197d73f7fad54c
- MD5 9043d712208178c33ba8e942834ce457
- SHA1 e0fa5c730bf127a33348f5d2a5673260ae3719d1
- SHA512 dd6fa02ab70c58cde75fd4d4714e0ed0df5d3b18f737c68c93dba40c30376cc93957f8eef69fea86041489546ce4239b35a3b5d639472fd54b80f2f7260c8f65
- SSDEEP 24576:FDy7cKOfkiRrXP5WtJvW1mpjSWr7uoZme1V86:+8/AtJes1LJ
- TLSH T149654A01AFE6C72BD69F97F6D87206142BF4D049B3ABF79F161863A91C837425C06227
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1456282
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
948B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.0/Sounds/Chat.wav
- SHA256 45f4136e58a5f749d125d2ab54308f81954d2c5b364b66013660a6c358845d1e
- MD5 832a3652fd780edcdb2439ec33532c0d
- SHA1 f0754ee6519d77700f5ee5b744b8c99386d7b577
- SHA512 3b3b55afcdfa00d9b7085b20ed52a7b4d8b7d403f5d0d1c539781db1a20257efd8c856e19b8f32ea33766a580690b498ff063849519691a9a4cbbcd3e9447cd4
- SSDEEP 768:QVPqefmaP5C3KduJn13jSHYHzIcr6DPW75Pvi3Fy5NQbIbhuJLA+LhDclY3Rp6:yP1mU5GlJnBS4TIQ6o163ofQ8b4Pfm
- TLSH T1B9235CD0E142DE00C4829D6ECE16E5E047337A95EF4B67173004BF6A39E35C2AA6E7D9
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.0/Sounds/Intro.wav
- SHA256 e3e5029bf5f29fa32d2f6cdda35697cd8e6035d5c78615f64d0b305d1bd926cf
- MD5 ad3b4fae17bcabc254df49f5e76b87a6
- SHA1 1683ff029eebaffdc7a4827827da7bb361c8747e
- SHA512 3d6ecc9040b5079402229c214cb5f9354315131a630c43d1da95248edc1b97627fb9ba032d006380a67409619763fb91976295f8d22ca91894c88f38bb610cd3
- SSDEEP 3072:FU3hYG9X9JzhaLL5+QYKHZDa6D+4LT92KEpcP+b8FGUt0Ybs5e9jXjubLtNmBNs9:GjVsLL5lva6D+4P9llWvaGe9CHeBNm
- TLSH T177347CD2E104A690D83989329D1669954B233AEFFF8A33353084F73674E3442DB6D6DB
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.0/XWorm V6.0.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e8ca2540ea99207e0dcd0a97deff106cd1dc77c2c73d9420aa0b293d697dfd6e
- MD5 477fba5055308b20dbf2df25ae0f89ee
- SHA1 bf1258a45f30de094475b119d233ae0a57ece36b
- SHA512 89dd023f9ac054dcdf97d7fc03a9119b0f2bac5d109f69206406a448777d3541b49ff67a01d4b4c46884c6d80f08b2c44dd83fe8abb87d1a4f95423036b4dee0
- SSDEEP 98304:njs0M4+8D3f37ST/JPa71uWTvLP9Pk6gAK6n4ldyNhe7ul5V9tRGaKB:njkg37mPah7L1kehn4ie7w934
- TLSH T1F1C64912F2818416E87815B004174AB075B4BE497F6CD9B67CCA772C2AF61ECB92F7E1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
12444414
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
11.9MB
Virtual Size
11.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ