Xen-OFCrypt.rar
- SHA256 8f9a4508d016fdf0dec57fec24b185fce869ed0bcae153c439803bfe592772be
Static task
static1
1 signatures
General
- Target Xen-OFCrypt.rar
- Size 1.5MB
- Sample261024-tw9rtacx2m
- SHA256 8f9a4508d016fdf0dec57fec24b185fce869ed0bcae153c439803bfe592772be
- MD5 079a8cdf5d4faff737c44d5379dd454b
- SHA1 1158bf995db7578afbf9879cf5b1b1d484236553
- SHA512 845404127e449c8b81b7c9e8fdc2e43679152e80d842d9dd34f61974f79ab8ab0f92381122daaeba00229a0a55df8c60eb91aceb5c13885a69547c99868c40f1
- SSDEEP 24576:N6OUT0xFTSVXS9Zoo2ywYQfq5B7xMo07LNUXk5YwCkLWMW2lGMz4Nj7XUX144iLr:tc0qsLoo2ywQxMoALqXk3CPGG+wj7XKa
- TLSH T14A6533289B85EE6E70EB3C406C4278787E5A5F110559FAF3F1C97F274588AEC8471A23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Xen-OFCrypt/Builder/XanthoroxCrypted.dll unpack001/Xen-OFCrypt/Builder/XanthoroxCrypted.exe unpack001/Xen-OFCrypt/Stub/Stub.exe
File Explorer
-
Xen-OFCrypt.rar.rar 1.5MB
-
Xen-OFCrypt/Builder/XanthoroxCrypted.deps.json440B
-
Xen-OFCrypt/Builder/XanthoroxCrypted.dll.exe 354KB
-
Xen-OFCrypt/Builder/XanthoroxCrypted.exe.exe 1.3MB
-
Xen-OFCrypt/Builder/XanthoroxCrypted.runtimeconfig.json516B
-
Xen-OFCrypt/Stub/Stub.exe.exe 1.2MB
Xen-OFCrypt/Builder/XanthoroxCrypted.deps.json
- SHA256 e120e3ae249f43b541a9f08f723ca937c9041535ab5ba4d759f287d92cba063b
- MD5 d2a6c10409a92b28ca9f07a4515611bc
- SHA1 5705f2d37b6c8d0b3d4da5f6d47af1793943dab2
- SHA512 fb1d7f37c0deacbdbbb6c088a70c71b97465241477cf44cc57e5b76ed0d4e654ca154170c0f6d585afd77299412bf6fbe282bd41313c32c6e87162b6488fcb79
- TLSH T1AAF06D59F5941CD712FA33F556368787F6226B370021190675FEA01C0FB2E175610EA9
- MD5 SHA1 SHA512 TLSH
Xen-OFCrypt/Builder/XanthoroxCrypted.dll
- SHA256 4c3002aeefcd5aa18ce59539897e39531796d670080f3b8a36cabc341782333a
- MD5 65990881e59a773f7a56cbe44c30a38d
- SHA1 fd7d6f37fd56ea95d8eb37704c90f9acbd406f87
- SHA512 48f3b4cf727e6d894aa1f825ea02df6e8f3eb95a84fedbe30148abebdb6405e776f5b57a1633df54fc65b812780cee0c229d0f7f5ca050a9c9bd2e86bd8e97ca
- SSDEEP 6144:BxbzWNVgF5mNPYeyZt43s90CmyeSz1SCi2NMqqxMepK6H1ZbJEmHl3FovllRcknu:BdzuVC5mNgJ83s90CmyeSz1SCi2NMqqj
- TLSH T1B7749D3EB6DA4F46C3682A3AC4B7082003F6A5963B33D7C93B0905ED2D557A6ED453D8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
352KB
Virtual Size
351KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
Xen-OFCrypt/Builder/XanthoroxCrypted.exe
- IMPHASH 16ea232736a39f84e9f62be00fdddbb6
- SHA256 50e078feea0e469434ef9c8a2ef991fc9e7b918dbcbb1d90879eb3b882668fd2
- MD5 5a7697f1292d6896fa603e59bf9d140a
- SHA1 490c0431550389e40d3c1ce10b1dd4a1191ff73e
- SHA512 2484a75e145cf5d74c432d5b1d083cea45744628dcb8431a9b24d30d19233516b1c2cff96644c7afcf572f2c9e81002dd2246de30af2dc5db477f1938817238a
- SSDEEP 12288:jcI/pT34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilA:j/ySnnrFb4PM4MYgLxEVyGLO
- TLSH T1A155F10372E801FDD6BBA3B485A25A45F37678259B31A3CF1350942A2F777C49DBA321
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
74352
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
shell32
ShellExecuteW
advapi32
DeregisterEventSource
RegGetValueW
RegOpenKeyExW
RegisterEventSourceW
ReportEventW
RegCloseKey
kernel32
TlsFree
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetStdHandle
GetModuleHandleExW
GetFinalPathNameByHandleW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
FindClose
CreateFileW
MultiByteToWideChar
GetConsoleMode
GetLastError
GetFileAttributesExW
LoadLibraryA
CloseHandle
WriteConsoleW
GetProcAddress
DeleteCriticalSection
GetModuleHandleW
WideCharToMultiByte
IsWow64Process
LoadLibraryExW
CreateActCtxW
ActivateActCtx
FindResourceW
GetWindowsDirectoryW
FreeLibrary
GetSystemTimeAsFileTime
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SwitchToThread
GetCurrentThreadId
GetStringTypeW
QueryPerformanceCounter
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
user32
MessageBoxW
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
__stdio_common_vfwprintf
fputwc
_wfsopen
__acrt_iob_func
fflush
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf
api-ms-win-crt-runtime-l1-1-0
__p___wargv
__p___argc
_configure_wide_argv
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
_get_initial_wide_environment
_register_onexit_function
_c_exit
abort
_initterm
_initterm_e
_set_app_type
_register_thread_local_exe_atexit_callback
_errno
terminate
exit
_exit
_initialize_wide_environment
_seh_filter_exe
_cexit
_crt_atexit
api-ms-win-crt-string-l1-1-0
wcsnlen
strcpy_s
_wcsdup
toupper
wcsncmp
api-ms-win-crt-convert-l1-1-0
_wtoi
wcstoul
api-ms-win-crt-time-l1-1-0
wcsftime
_time64
_gmtime64_s
api-ms-win-crt-locale-l1-1-0
_unlock_locales
_configthreadlocale
_free_locale
_create_locale
setlocale
___mb_cur_max_func
_lock_locales
__pctype_func
___lc_codepage_func
___lc_locale_name_func
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
calloc
_set_new_mode
free
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
90KB
Virtual Size
90KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
808B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1.2MB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=10, id=259, version=33731,
count=12, id=260, version=33731,
count=87, id=261, version=33731,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33136,
count=206, id=1, productName=Unmarked objects,
count=10, id=265, version=33811,
count=1, id=258, version=33811,
Xen-OFCrypt/Builder/XanthoroxCrypted.runtimeconfig.json
- SHA256 05917b409d59af31bc8d3021bc06302a0c21c7d05b449603d6cc9f0301a2b66c
- MD5 6cc5992b5f24e3ff259ff61441f0bce9
- SHA1 98e9fecdc80c90f6d250b9afca50eab4c4c0151b
- SHA512 64b9612846b342fd254c439be1833b4fde0e7bcea5979879d333b54a7633a9936df65639101ddb28023a3877f9a4dd1cbde29b2dfe79538bec48cc4a8aecb377
- TLSH T150F02069CA106DA704B937BAC63AC182FB30573B00041D92B9FC080C2F77DB22212F89
- MD5 SHA1 SHA512 TLSH
Xen-OFCrypt/Stub/Stub.exe
- IMPHASH 1a00105d1ef61f1c00dfee36695ac5d6
- SHA256 2fe4548e24420b1e339504cfb01460a262954c8ed21428ef353609da1e2047aa
- MD5 d4987d28d65ee612b16498bc0064dcf9
- SHA1 685669fa22f2561ecdd370fbff23ddb2708e4519
- SHA512 aa8d6cfc6d154a8fb0faf419791caab57596d5ffc6b2e91ea533ce4d23566e2e875de214f89ba5172d375feb2f0f7870e6f980d04f7363b0dcc64add46480188
- SSDEEP 24576:0g4IPc/XkjoSnnrFb4PM4MYgLxEVyGLu:94qRj4MYPVyGLu
- TLSH T1ED45021B77E830FDDD6B8670C1554A46F73678316730ABAF0394523A2F276869C3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
37400
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
wsprintfA
MessageBoxA
kernel32
GlobalMemoryStatusEx
GetSystemInfo
GetTickCount
GetTickCount64
HeapAlloc
HeapFree
GetProcessHeap
CloseHandle
TerminateProcess
ResumeThread
CreateProcessW
GetThreadContext
SetThreadContext
VirtualAlloc
VirtualProtect
VirtualFree
VirtualAllocEx
ReadProcessMemory
WriteProcessMemory
LoadLibraryA
SwitchToFiber
DeleteFiber
CreateFiber
ConvertThreadToFiber
EnumSystemLocalesA
GetCurrentProcess
GetProcAddress
CreateFileA
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
WaitForSingleObject
GetCurrentThread
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
GetVolumeInformationW
GetWindowsDirectoryA
GetComputerNameA
CreateThread
FreeLibrary
DeleteFileW
GetFileAttributesW
GetTempPathW
HeapCreate
HeapDestroy
GetSystemDirectoryA
GetComputerNameW
WideCharToMultiByte
Sleep
CheckRemoteDebuggerPresent
GetModuleFileNameW
ExitProcess
WriteConsoleW
LCMapStringW
GetModuleHandleA
CreateFileW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
FlsFree
HeapSize
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EncodePointer
GetStdHandle
WriteFile
GetModuleHandleExW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
FlsAlloc
FlsGetValue
FlsSetValue
advapi32
RegOpenKeyExA
RegSetValueExW
RegOpenKeyExW
RegCloseKey
GetUserNameW
RegQueryValueExA
bcrypt
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptDestroyKey
BCryptDecrypt
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptSetProperty
BCryptOpenAlgorithmProvider
BCryptGenerateSymmetricKey
?Watermark@Protection@@3PEBDEB
Name
.text
Size
87KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
46KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xthrx
Size
517KB
Virtual Size
517KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
160B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
568KB
Virtual Size
572KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=5, id=259, version=30795,
count=139, id=261, version=30795,
count=10, id=260, version=30795,
count=9, id=259, version=34321,
count=17, id=260, version=34321,
count=44, id=261, version=34321,
count=11, id=257, version=30795,
count=150, id=1, productName=Unmarked objects,
count=24, id=261, version=34435,
count=1, id=256, version=34435,
count=1, id=258, version=34435,