XWORM.5.6.rar
- SHA256 4d1a6d4a573cfe2ca8ab2ffcf4fd38c0814f37d234f582ab5b7deb951ebd1296
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
XORM.5.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target XWORM.5.6.rar
- Size 26KB
- Sample260818-tgbapsvgnd
- SHA256 4d1a6d4a573cfe2ca8ab2ffcf4fd38c0814f37d234f582ab5b7deb951ebd1296
- MD5 21dea3f3f614e1908a51d4cd1423bce4
- SHA1 c541b5aaecfc3b1260e91d5442264a3cc0c830a7
- SHA512 0cdaa70ba19ef5298c77835d1d7df0cb0bbc1d5cc03ac584ea4144bb2433ee0f592b882d5cbf12032e32080dcf38392e2a729fee90571ec3df72f27d134e70a5
- SSDEEP 768:mjnDhPomwsqLcbz282UwJcNHQCQdOBzxcVe7s24dW5D:2Dim3mN0ZhQdOX5D4dA
- TLSH T1E4C2E03A87A866D84C039D35F40703AFFD25A5215EDEE43BBA34319B4BC69C67D8C950
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/XORM.5.exe
File Explorer
-
XWORM.5.6.rar.rar 26KB
-
XORM.5.exe.exe 55KB
XORM.5.exe
- IMPHASH 626c4d346b8414e31b596db987ded118
- SHA256 7f473f00be808a20148f9d97dca48e0dc4e3af967f2a13e0170c38aa1fceec09
- MD5 84a0f585333876e0c20e99bbefa086b7
- SHA1 713c82a9bc0afe3ac7f9ead9da05d62cb4474f17
- SHA512 29fa346423c31fa4bf833a515d7b63aaca63811061c7a5a50e17efcc9adf787801e98407e60714f9ffe1a1f84ba187f01b52bfa83b7400ab1a1e562aa6d7cfc8
- SSDEEP 768:NbO0qzDNk6k8JL79nDTdypHu4m0Bsm4+RxckRUNmlzXpxuvw1bID5yAIH:N60Axk69JD5iHDLUJN0psvwZAI
- TLSH T1D4430A0AF34364ECC50BC6B846EF6673BA31BD6241355F7F1754E6701E10E60AE6EA18
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5328
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
CryptAcquireContextA
CryptCreateHash
CryptDestroyHash
CryptGenRandom
CryptGetHashParam
CryptHashData
CryptReleaseContext
GetUserNameA
bcrypt
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptDecrypt
BCryptDestroyHash
BCryptDestroyKey
BCryptEncrypt
BCryptFinishHash
BCryptGenRandom
BCryptGenerateSymmetricKey
BCryptGetProperty
BCryptHashData
BCryptImportKeyPair
BCryptOpenAlgorithmProvider
BCryptSetProperty
kernel32
CloseHandle
CreateFileA
CreateMutexA
CreatePipe
CreateProcessA
DeleteCriticalSection
EnterCriticalSection
ExitProcess
ExpandEnvironmentStringsA
FreeLibrary
GetComputerNameA
GetCurrentDirectoryW
GetCurrentProcessId
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetTickCount
HeapAlloc
HeapFree
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
OpenProcess
PeekNamedPipe
ReadFile
SetHandleInformation
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WTSGetActiveConsoleSessionId
WaitForSingleObject
WideCharToMultiByte
WriteFile
msvcrt
__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_commode
_errno
_fmode
_initterm
_onexit
_strdup
_stricmp
abort
calloc
exit
fprintf
fputc
free
fwrite
localeconv
malloc
memcpy
realloc
signal
strerror
strlen
strncmp
strncpy
vfprintf
wcslen
ws2_32
WSAIoctl
WSAStartup
closesocket
connect
freeaddrinfo
getaddrinfo
recv
send
setsockopt
socket
Name
.text
Size
40KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
240B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
140B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ