9edf2ea67490be79d8b2913d6e5887ac

PE Executable
|
MD5: 9edf2ea67490be79d8b2913d6e5887ac
|
Size: 10.73 MB
|
application/x-dosexec

Infection Chain

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	9edf2ea67490be79d8b2913d6e5887ac
Sha1	4d7a81b0bc38cac442f80c81a3ff3de1beef3159
Sha256	44cbb9ba318ddc687dca3e0dfeba30db5469d50c9bbdbbfb5888efdd9889439e
Sha384	c128aa88977a6fadea69ec2d429e2ebb1fa0f240eb56b5674454ebee505e04b97b46153dbd5bb9bb9ceae72d2d629a22
Sha512	82d175be7146ad41fe7b491b6a60a71fc461d72be20b639abe37645b0e6d8af1e01c67c98cd02e0ed9a5401bc92e048e7d6941384f3283245ce37546af9738d5
SSDeep	196608:WmmunL7Y01Kwo2g9oiRzOtuRwZYrL1kehn4i7jy:WNunLk0Xo2g9oilOtutRka4i7jy
TLSH	CBB67B06B281C802CC7819B148164FE066B47E8D5F68D9A5B8C8777C6BFA1CDB1677F2

PeID

Borland Delphi 7 - Nstd EP - ASL sign

HQR data file

Microsoft Visual C++ 6.0 DLL (Debug)

Microsoft Visual C++ 7.0 - 8.0

Microsoft Visual C++ v6.0 DLL

Microsoft WAV Audio file

PureBasic DLL -> Neil Hodgson

UPolyX 0.3 -> delikon

File Structure

Malware Configuration - XWorm config.

Config. Field0	Value
Mutex	abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
SPL	-=>
KEY	abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
family	xworm

Informations

Name0	Value
Info	PE Detect: PeReader OK (file layout)

Artefacts

Name0	Value
URLs in VB Code - #1	http://www.w3.org/1999/02/22-rdf-syntax-ns#
URLs in VB Code - #2	http://ns.adobe.com/xap/1.0/mm/
URLs in VB Code - #3	http://ns.adobe.com/xap/1.0/sType/ResourceRef#
URLs in VB Code - #4	http://ns.adobe.com/xap/1.0/
URLs in VB Code - #5	http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd
URLs in VB Code - #6	http://www.w3.org/1999/xhtml
URLs in VB Code - #7	https://api.telegram.org/bot
URLs in VB Code - #8	http://ip-api.com/line/?fields=hosting
URLs in VB Code - #9	https://docs.microsoft.com/windows/win32/fileio/maximum-file-path-limitation
URLs in VB Code - #10	http://schemas.microsoft.com/SMI/2005/WindowsSettings
URLs in VB Code - #11	http://schemas.microsoft.com/SMI/2016/WindowsSettings
URLs in VB Code - #1	https://docs.microsoft.com/windows/win32/fileio/maximum-file-path-limitation
URLs in VB Code - #2	http://schemas.microsoft.com/SMI/2005/WindowsSettings
URLs in VB Code - #3	http://schemas.microsoft.com/SMI/2016/WindowsSettings
URLs in VB Code - #1	http://www.w3.org/1999/02/22-rdf-syntax-ns#
URLs in VB Code - #2	http://ns.adobe.com/xap/1.0/mm/
URLs in VB Code - #3	http://ns.adobe.com/xap/1.0/sType/ResourceRef#
URLs in VB Code - #4	http://ns.adobe.com/xap/1.0/
URLs in VB Code - #5	http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd
URLs in VB Code - #6	http://www.w3.org/1999/xhtml
URLs in VB Code - #7	https://api.telegram.org/bot
URLs in VB Code - #8	http://ip-api.com/line/?fields=hosting
URLs in VB Code - #9	https://docs.microsoft.com/windows/win32/fileio/maximum-file-path-limitation
URLs in VB Code - #10	http://schemas.microsoft.com/SMI/2005/WindowsSettings
URLs in VB Code - #11	http://schemas.microsoft.com/SMI/2016/WindowsSettings
Mutex	abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
URLs in VB Code - #1	https://docs.microsoft.com/windows/win32/fileio/maximum-file-path-limitation
URLs in VB Code - #2	http://schemas.microsoft.com/SMI/2005/WindowsSettings
URLs in VB Code - #3	http://schemas.microsoft.com/SMI/2016/WindowsSettings
URLs in VB Code - #1	http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd
URLs in VB Code - #2	http://www.w3.org/1999/xhtml
URLs in VB Code - #3	https://api.telegram.org/bot
URLs in VB Code - #4	http://ip-api.com/line/?fields=hosting

9edf2ea67490be79d8b2913d6e5887ac (10.73 MB)