Malicious
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
The file 103e6d41dae6e77c849c7d763ed36840 is a PE Executable identified by Malva.RE as XWorm (rat). Static analysis extracted 7 embedded or derived files. It matches 6 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- —
- MD5
- -
- Verdict
- Malicious
- File type
- PE Executable
- Family
- XWorm
- Category
- RAT
Related XWorm samples
- c96f81d0ddbc29f0315c4b0809d97e280051a016b6a6852e5bd88e1a6ec235bc 2026-10-29
- f0f686989d043a10a7f5ee442fc97877ac52b9baf16b4cdca1191dd9631efc4c 2026-10-29
- 1891b91cbe07657794700e6c8eab5ef7a4c64ed0fb8ab1e1f14fdef66c074386 2026-10-28
- d515d3eeb16636e316345494bf98a312b59bb7f5c226faa6c64ca2e6980f3185 2026-10-28
- 9758f758b221d0ab47e831ce9ec8dee2e8d9fbb58d3c91b0ce056fa1f6fa0cfd 2026-10-28
- 830fdb947aa60a491d22c8f698e9531fdd651f76cecafd3350d408442db4c59e 2026-10-28
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Detection
PeID
Free Pascal v0.99.10Microsoft Visual C++ 8.0 (DLL)Microsoft Visual C++ v6.0 DLL
1 malicious · 7 files
EXE103e6d41dae6e77c849c7d763ed36840XWorm
EXEOverlay_12435dac.bin
| Name | Value |
|---|---|
| Info | Overlay extracted: Overlay_12435dac.bin (30656 bytes) |
PE Layout
UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential