04387c900c2791835e8d896c0c993c50
PE Executable | MD5: 04387c900c2791835e8d896c0c993c50 | Size: 39.94 KB | application/x-dosexec
Symbol Ofbuscation Score
|
Hash | Hash Value |
|---|---|
| MD5 | 04387c900c2791835e8d896c0c993c50
|
| Sha1 | be5df558f5bbabcf95c80a90a51f02daa872b673
|
| Sha256 | 5b3cb89cf9d208f77139e62fb78daf1a510fcd0a2a385d914fd8dc63dca5e405
|
| Sha384 | 8e8415d63168556d290cdb8f5d72972da0d72588010e1bc92c6b07e2ea06a34f62c1c389d3fd2e57dabd0d5f7923ea7d
|
| Sha512 | f32d9220e3d1437620f77b0f712b364c95c1d4090b7e6e64f67efc660a74349759c0b8a9cefb4fa8fd148b0e7d816dceecab55a1dc1c9cd69f11da704b07078c
|
| SSDeep | 768:DPERNgs7Mr5oyty4xD2MEkxc6/F5P99jKt6SOMhl33M:4jAr5xt19mkeYFX9+t6SOMbc
|
| TLSH | 46034C493BD04625D6EEBFF968B3A2060B70F5139913DB8E0CD8495A2B37BC48A047D7
|
PeID
|
Config. Field0 | Value |
|---|---|
| Mutex | tWa2yHH8f8KWRexA |
| Hosts | 194.62.29.172 |
| Port | 1177 |
| KEY | <1234567890> |
| USBNM | <XWormmm> |
| family | xworm |
|
Name0 | Value |
|---|---|
| Info | PE Detect: PeReader OK (file layout) |
| Module Name | XWormClient2323.exe |
| Full Name | XWormClient2323.exe |
| EntryPoint | System.Void Stub.Main::Main() |
| Scope Name | XWormClient2323.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | XWormClient2323 |
| Assembly Version | 1.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 210 |
| Main Method | System.Void Stub.Main::Main() |
| Main IL Instruction Count | 75 |
| Main IL | ldsfld System.Int32 Settings::Sleep ldc.i4 1000 mul.ovf <null> call System.Void System.Threading.Thread::Sleep(System.Int32) ldsfld System.String Settings::Hosts call System.Object Stub.AlgorithmAES::Decrypt(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Settings::Hosts ldsfld System.String Settings::Port call System.Object Stub.AlgorithmAES::Decrypt(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Settings::Port ldsfld System.String Settings::KEY call System.Object Stub.AlgorithmAES::Decrypt(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Settings::KEY ldsfld System.String Settings::SPL call System.Object Stub.AlgorithmAES::Decrypt(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Settings::SPL ldsfld System.String Settings::Group call System.Object Stub.AlgorithmAES::Decrypt(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Settings::Group ldsfld System.String Settings::USBNM call System.Object Stub.AlgorithmAES::Decrypt(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Settings::USBNM leave.s IL_009E: call System.Boolean Stub.Helper::CreateMutex() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.2 <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_009E: call System.Boolean Stub.Helper::CreateMutex() call System.Boolean Stub.Helper::CreateMutex() brtrue.s IL_00AB: call System.Void Stub.Main::RunAntiAnalysis() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Stub.Main::RunAntiAnalysis() leave.s IL_00C0: call System.Void Stub.Main::Exclusion() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.3 <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_00C0: call System.Void Stub.Main::Exclusion() call System.Void Stub.Main::Exclusion() call System.Void Stub.Helper::PreventSleep() ldnull <null> ldftn System.Void Stub.Main::_Lambda$__1() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() call System.String Stub.ClientSocket::UAC() call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String) brfalse.s IL_00F1: ldnull call System.Void Stub.ProcessCritical::CriticalProcess_Enable() ldnull <null> ldftn System.Void Stub.Main::_Lambda$__2() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.0 <null> ldnull <null> ldftn System.Void Stub.Main::_Lambda$__3() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldloc.0 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.1 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.1 <null> callvirt System.Void System.Threading.Thread::Join() ret <null> |
| Module Name | XWormClient2323.exe |
| Full Name | XWormClient2323.exe |
| EntryPoint | System.Void Stub.Main::Main() |
| Scope Name | XWormClient2323.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | XWormClient2323 |
| Assembly Version | 1.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 210 |
| Main Method | System.Void Stub.Main::Main() |
| Main IL Instruction Count | 75 |
| Main IL | ldsfld System.Int32 Settings::Sleep ldc.i4 1000 mul.ovf <null> call System.Void System.Threading.Thread::Sleep(System.Int32) ldsfld System.String Settings::Hosts call System.Object Stub.AlgorithmAES::Decrypt(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Settings::Hosts ldsfld System.String Settings::Port call System.Object Stub.AlgorithmAES::Decrypt(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Settings::Port ldsfld System.String Settings::KEY call System.Object Stub.AlgorithmAES::Decrypt(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Settings::KEY ldsfld System.String Settings::SPL call System.Object Stub.AlgorithmAES::Decrypt(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Settings::SPL ldsfld System.String Settings::Group call System.Object Stub.AlgorithmAES::Decrypt(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Settings::Group ldsfld System.String Settings::USBNM call System.Object Stub.AlgorithmAES::Decrypt(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Settings::USBNM leave.s IL_009E: call System.Boolean Stub.Helper::CreateMutex() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.2 <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_009E: call System.Boolean Stub.Helper::CreateMutex() call System.Boolean Stub.Helper::CreateMutex() brtrue.s IL_00AB: call System.Void Stub.Main::RunAntiAnalysis() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Stub.Main::RunAntiAnalysis() leave.s IL_00C0: call System.Void Stub.Main::Exclusion() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.3 <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_00C0: call System.Void Stub.Main::Exclusion() call System.Void Stub.Main::Exclusion() call System.Void Stub.Helper::PreventSleep() ldnull <null> ldftn System.Void Stub.Main::_Lambda$__1() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() call System.String Stub.ClientSocket::UAC() call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String) brfalse.s IL_00F1: ldnull call System.Void Stub.ProcessCritical::CriticalProcess_Enable() ldnull <null> ldftn System.Void Stub.Main::_Lambda$__2() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.0 <null> ldnull <null> ldftn System.Void Stub.Main::_Lambda$__3() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldloc.0 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.1 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.1 <null> callvirt System.Void System.Threading.Thread::Join() ret <null> |
|
Name0 | Value |
|---|---|
| Mutex | tWa2yHH8f8KWRexA |
| CnC | 194.62.29.172 |
| Port | 1177 |
|
Config. Field0 | Value |
|---|---|
| Mutex | tWa2yHH8f8KWRexA |
| Hosts | 194.62.29.172 |
| Port | 1177 |
| KEY | <1234567890> |
| USBNM | <XWormmm> |
| family | xworm |
|
Name0 | Value | Location |
|---|---|---|
| Mutex | tWa2yHH8f8KWRexA Malicious |
04387c900c2791835e8d896c0c993c50 |
| CnC | 194.62.29.172 Malicious |
04387c900c2791835e8d896c0c993c50 |
| Port | 1177 Malicious |
04387c900c2791835e8d896c0c993c50 |