168e24a7d9498172a32b51885248f7e51adf1cd11d4126662d2e4ffe575a5bbf.bin
- SHA256 168e24a7d9498172a32b51885248f7e51adf1cd11d4126662d2e4ffe575a5bbf
Overview
overview
10Static
static
10bp/AdbWinApi.dll
windows10-2004-x64
3bp/AdbWinApi.dll
windows11-ltsc_2024-x64
3bp/Hacks/hack.exe
windows10-2004-x64
10bp/Hacks/hack.exe
windows11-ltsc_2024-x64
10bp/NanoBypass.exe
windows10-2004-x64
10bp/NanoBypass.exe
windows11-ltsc_2024-x64
10bp/adb.exe
windows10-2004-x64
10bp/adb.exe
windows11-ltsc_2024-x64
10bp/injecter.dll
windows10-2004-x64
1bp/injecter.dll
windows11-ltsc_2024-x64
1Behavioral task
behavioral1
Sample
bp/AdbWinApi.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
bp/AdbWinApi.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
bp/Hacks/hack.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
bp/Hacks/hack.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
bp/NanoBypass.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral6
Sample
bp/NanoBypass.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
Behavioral task
behavioral7
Sample
bp/adb.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral8
Sample
bp/adb.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral9
Sample
bp/injecter.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
bp/injecter.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target 168e24a7d9498172a32b51885248f7e51adf1cd11d4126662d2e4ffe575a5bbf.bin
- Size 10.0MB
- Sample260925-3agctayfrb
- SHA256 168e24a7d9498172a32b51885248f7e51adf1cd11d4126662d2e4ffe575a5bbf
- MD5 3f733ae276ac32c75d03d63b5220ae13
- SHA1 dbe877031e934d53110f5cb5d366822a2a387496
- SHA512 eb77a68e03fa53aca69ffa15308eee1b8e2f8041ed8e1075c08a389f84dd1ac911fe0688b94fa357baa5fbb83d2e86755a689bc9d9dfac1a27ff64581b25a102
- SSDEEP 196608:/Vx/8r7G6Tw/OVCdADccTd7i94M43R9KC1x5lMrgziFc6PJy1p8mxe:N58rdTYwCdAQE24M43RAC1PlM7c6Rxm0
- TLSH T137B63395EDA7A92E1F00B8071F801E44BFDC1CFABDBD2C2653BE66A4A0954FD049D81D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
xworm
Version
-
XWorm V6.5 by c3lestial.fun
C2
-
pakazadi1145-52069.portmap.host:52069
Mutex
-
4m3uHdKp7RlanClr
Attributes
-
Install_directory
%ProgramData%
-
install_file
Services.exe
aes.plain
Signatures
- Detect Xworm Payload 2 IoCs
resource yara_rule static1/unpack001/bp/Hacks/hack.exe family_xworm static1/unpack001/bp/adb.exe family_xworm - Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/bp/Hacks/hack.exe unpack001/bp/NanoBypass.exe unpack001/bp/adb.exe
File Explorer
-
168e24a7d9498172a32b51885248f7e51adf1cd11d4126662d2e4ffe575a5bbf.bin.zip 10.0MB
-
bp/AdbWinApi.dll.dll 104KB
-
bp/Hacks/hack.exe.exe 41KB
-
bp/NanoBypass.exe.exe 9.9MB
-
bp/adb.exe.exe 41KB
-
bp/injecter.dll139KB
bp/AdbWinApi.dll
- IMPHASH c64cac39044626770353879245ea25e4
- SHA256 8dd478b2c2cbfc07b15b5effe428c0a156a5636643f35afcb0256110dc316a5f
- MD5 612837236ca2cbd1bd81ba0000e90422
- SHA1 38897f445db0e65b2cd8b36ba7a5af631c793afe
- SHA512 d9d93ebc5b737bf0b38f4efe3c00fb4a82821fc8e918865a8fb47ee76cdb4455a836c41dd816b07701f7561a55848098f9418c18ab02ada73e733131d6d9b73d
- SSDEEP 1536:EpCxybY0FS6MqS6WvgD9xj03TabrFvY5J6sCGt77q:Epo0k6ZWVTaif6sCGtG
- TLSH T194A36B313891C472D8D372B955ECF675A27EE0A00B6589C3379803DEDE643C26E7929B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e9:6f:46:48:ce:bd:44:2f:b6:15:06:8f:d7:eb:c8:a0:fd:c2:91:c8:fe:da:4c:93:9c:60:1a:97:6c:9e:cc:00
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN
Chains
Aug 5, 2025
CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN
Serial Number
0d:da:f2:fe:51:f3:b2:e9:4c:bb:69:5a:4a:51:74:fc
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 18, 2022 - Oct 17, 2025
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
30527
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\code\android\donut\development\host\windows\usb\api\objfre_wxp_x86\i386\AdbWinApi.pdb
ole32
CoCreateInstance
kernel32
GetACP
SetLastError
CloseHandle
GetLastError
DeviceIoControl
WriteFile
ReadFile
GetOverlappedResult
CreateFileW
WideCharToMultiByte
Sleep
InterlockedIncrement
InterlockedDecrement
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetProcAddress
LoadLibraryW
GetFileAttributesW
GetSystemDirectoryW
RaiseException
FreeLibrary
InterlockedExchange
InitializeCriticalSectionAndSpinCount
GetCommandLineA
GetVersionExA
RtlUnwind
HeapFree
HeapAlloc
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCPInfo
GetOEMCP
OutputDebugStringA
VirtualAlloc
HeapReAlloc
HeapSize
LoadLibraryA
GetModuleHandleW
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetFilePointer
GetConsoleCP
GetConsoleMode
VirtualProtect
GetSystemInfo
VirtualQuery
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
setupapi
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
??0AdbEndpointObject@@QAE@ABV0@@Z
??0AdbEndpointObject@@QAE@PAVAdbInterfaceObject@@EE@Z
??0AdbIOCompletion@@QAE@ABV0@@Z
??0AdbIOCompletion@@QAE@PAVAdbEndpointObject@@KPAX@Z
??0AdbInterfaceObject@@QAE@ABV0@@Z
??0AdbInterfaceObject@@QAE@PBG@Z
??0AdbObjectHandle@@QAE@ABV0@@Z
??0AdbObjectHandle@@QAE@W4AdbObjectType@@@Z
??1AdbEndpointObject@@MAE@XZ
??1AdbIOCompletion@@MAE@XZ
??1AdbInterfaceObject@@MAE@XZ
??1AdbObjectHandle@@MAE@XZ
??4AdbEndpointObject@@QAEAAV0@ABV0@@Z
??4AdbIOCompletion@@QAEAAV0@ABV0@@Z
??4AdbInterfaceObject@@QAEAAV0@ABV0@@Z
??4AdbObjectHandle@@QAEAAV0@ABV0@@Z
??_7AdbEndpointObject@@6B@
??_7AdbIOCompletion@@6B@
??_7AdbInterfaceObject@@6B@
??_7AdbObjectHandle@@6B@
?AddRef@AdbObjectHandle@@UAEJXZ
?AsyncRead@AdbEndpointObject@@UAEPAXPAXKPAK0K@Z
?AsyncWrite@AdbEndpointObject@@UAEPAXPAXKPAK0K@Z
?CloseHandle@AdbObjectHandle@@UAE_NXZ
?CreateHandle@AdbObjectHandle@@UAEPAXXZ
?GetEndpointInformation@AdbEndpointObject@@UAE_NPAU_AdbEndpointInformation@@@Z
?GetInterfaceName@AdbInterfaceObject@@UAE_NPAXPAK_N@Z
?GetParentInterfaceHandle@AdbEndpointObject@@QBEPAXXZ
?GetParentObjectHandle@AdbIOCompletion@@QBEPAXXZ
?GetUsbConfigurationDescriptor@AdbInterfaceObject@@UAE_NPAU_USB_CONFIGURATION_DESCRIPTOR@@@Z
?GetUsbDeviceDescriptor@AdbInterfaceObject@@UAE_NPAU_USB_DEVICE_DESCRIPTOR@@@Z
?GetUsbInterfaceDescriptor@AdbInterfaceObject@@UAE_NPAU_USB_INTERFACE_DESCRIPTOR@@@Z
?IsCompleted@AdbIOCompletion@@UAE_NXZ
?IsObjectOfType@AdbObjectHandle@@UBE_NW4AdbObjectType@@@Z
?IsOpened@AdbObjectHandle@@QBE_NXZ
?LastReferenceReleased@AdbObjectHandle@@MAEXXZ
?Lookup@AdbObjectHandle@@SGPAV1@PAX@Z
?Release@AdbObjectHandle@@UAEJXZ
?SyncRead@AdbEndpointObject@@UAE_NPAXKPAKK@Z
?SyncWrite@AdbEndpointObject@@UAE_NPAXKPAKK@Z
?Type@AdbEndpointObject@@SG?AW4AdbObjectType@@XZ
?Type@AdbIOCompletion@@SG?AW4AdbObjectType@@XZ
?Type@AdbInterfaceObject@@SG?AW4AdbObjectType@@XZ
?adb_handle@AdbObjectHandle@@QBEPAXXZ
?endpoint_id@AdbEndpointObject@@QBEEXZ
?endpoint_index@AdbEndpointObject@@QBEEXZ
?interface_name@AdbInterfaceObject@@QBEABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ
?object_type@AdbObjectHandle@@QBE?AW4AdbObjectType@@XZ
?overlapped@AdbIOCompletion@@QAEPAU_OVERLAPPED@@XZ
?parent_interface@AdbEndpointObject@@QBEPAVAdbInterfaceObject@@XZ
?parent_io_object@AdbIOCompletion@@QBEPAVAdbEndpointObject@@XZ
?usb_config_descriptor@AdbInterfaceObject@@QBEPBU_USB_CONFIGURATION_DESCRIPTOR@@XZ
?usb_device_descriptor@AdbInterfaceObject@@QBEPBU_USB_DEVICE_DESCRIPTOR@@XZ
?usb_interface_descriptor@AdbInterfaceObject@@QBEPBU_USB_INTERFACE_DESCRIPTOR@@XZ
AdbCloseHandle
AdbCreateInterface
AdbCreateInterfaceByName
AdbEnumInterfaces
AdbGetDefaultBulkReadEndpointInformation
AdbGetDefaultBulkWriteEndpointInformation
AdbGetEndpointInformation
AdbGetEndpointInterface
AdbGetInterfaceName
AdbGetOvelappedIoResult
AdbGetSerialNumber
AdbGetUsbConfigurationDescriptor
AdbGetUsbDeviceDescriptor
AdbGetUsbInterfaceDescriptor
AdbHasOvelappedIoComplated
AdbNextInterface
AdbOpenDefaultBulkReadEndpoint
AdbOpenDefaultBulkWriteEndpoint
AdbOpenEndpoint
AdbQueryInformationEndpoint
AdbReadEndpointAsync
AdbReadEndpointSync
AdbResetInterfaceEnum
AdbWriteEndpointAsync
AdbWriteEndpointSync
Name
.text
Size
80KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=116, id=1, productName=Unmarked objects,
count=17, id=125, productName=VS2005 build 50727, version=50727,
count=94, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=59, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
bp/Hacks/hack.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 fc09681147371570bc8949806316d25c1b08be701437b151da72a0c1ddac6e0e
- MD5 7cfe1c7c32f92c4a6afa088985fb095a
- SHA1 22ec12ce63932906604b408fb63044ac6a9af108
- SHA512 f2abc087ae2ff7698492f2248ac831776756bf53adb0c70591f21636c60c95ff4346b92ad9d1ae5948481a7d09fdcc3978d6365fce06d3523b404995e7f2819f
- SSDEEP 768:mbsRtmbHIZRqFZk8womL1dlrF5Pr9p5O6iOwhg3/OO:mbsQIZMnvBQpFp9TO6iOwOJ
- TLSH T1C3133A057B918625E5FDABB519B266030731E6038D23D79E0CE897DB2B67AC0CE807D7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detect Xworm Payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
47678
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
bp/NanoBypass.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 943e9cd98425574324495951d988f135eb75ac739d69af24dbfe6441398bb33b
- MD5 6ff8b61f5b517ae181d0b69388914aa3
- SHA1 2b4ddbf9e58e428b6d3cc2800f7078dd4beeb198
- SHA512 40b4753eb14074f61edfe60b7d7028d4e812f730e39681f55d4ea5d922390758704e842702b8e87dbfe8da04a3bdcf651229a92749acdf38903b0a1553cb2b31
- SSDEEP 196608:JWGVTwO8B4vcZaHDgrJ1cZrogTnb9uhZth+XojmRO7Mk1fKgZ:sGVfy8cZajyyrogTnJuhDh+XOovgZ
- TLSH T12CA6335CAE1EE05BC7015C396E982A04AFD82CD9ADF61C1F37BB15C4E0215FE05A963E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10422750
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
9.9MB
Virtual Size
9.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
bp/adb.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 fc09681147371570bc8949806316d25c1b08be701437b151da72a0c1ddac6e0e
- MD5 7cfe1c7c32f92c4a6afa088985fb095a
- SHA1 22ec12ce63932906604b408fb63044ac6a9af108
- SHA512 f2abc087ae2ff7698492f2248ac831776756bf53adb0c70591f21636c60c95ff4346b92ad9d1ae5948481a7d09fdcc3978d6365fce06d3523b404995e7f2819f
- SSDEEP 768:mbsRtmbHIZRqFZk8womL1dlrF5Pr9p5O6iOwhg3/OO:mbsQIZMnvBQpFp9TO6iOwOJ
- TLSH T1C3133A057B918625E5FDABB519B266030731E6038D23D79E0CE897DB2B67AC0CE807D7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detect Xworm Payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
47678
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
bp/injecter.dll
- SHA256 f78fc41103dfcc40af8a6341e9e2a13b45c505f479f1f1878571cbde98de27b1
- MD5 630bd0372bc3351aef97954476c76ecb
- SHA1 d9dddfeb1f3e437f49d71aaf9ec438776efac5ee
- SHA512 71a2405b0cb1052d7da8269ac300eb3f01b08fc9a2efdf3921e06c701c65c6b410162528c4699f099680c01868e678e14c3e827dbac34d00ae1a8d6fcdefaedc
- SSDEEP 3072:s01caxUO/gTA/MsPaHWRNbr8WKn9wzRkif+dAxQujXkm:rCaxUO/gTAUsiHWRN8gxQubkm
- TLSH T1BCD351FBB01293A9EFED6BF86C005C3257195C997478804EBCDCB614A742D8592FE2C5
- MD5 SHA1 SHA512 SSDEEP TLSH