Malicious
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
The file a0af147c7f1a7fc05883c5e5988abdf7 is a PE Executable identified by Malva.RE as XWorm (rat). Static analysis extracted 70 embedded or derived files. It matches 12 YARA rules. Static analysis cannot prove a file is harmless: an unknown or heavily packed threat can go undetected. The file was parsed and decompiled, never executed.
- SHA256
- —
- MD5
- -
- Verdict
- No known threat found
- File type
- PE Executable
- Family
- XWorm
- Category
- RAT
Related XWorm samples
- 02f7162f3a8bdef7d764ad6efcf6cada061fb50a6933e3b052b817195b42df19 2026-11-02
- a918ece64739fd805355df17b8cc8de205d8392e789a08a98648f383851d91fe 2026-11-02
- ab1d3375e08f47ffc0c6ad8a163b82bedcf3efd5c811855c140670a1e6780e2c 2026-10-31
- c96f81d0ddbc29f0315c4b0809d97e280051a016b6a6852e5bd88e1a6ec235bc 2026-10-29
- f0f686989d043a10a7f5ee442fc97877ac52b9baf16b4cdca1191dd9631efc4c 2026-10-29
- 1891b91cbe07657794700e6c8eab5ef7a4c64ed0fb8ab1e1f14fdef66c074386 2026-10-28
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Detection
PeID
Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 8.0 (DLL)Microsoft Visual C++ v6.0 DLL
2 malicious · 71 files
EXEa0af147c7f1a7fc05883c5e5988abdf7XWorm
EXEOverlay_748984c2.bin
EXE[Rebuild from dump]_0035356a.exeXWorm
| Name | Value |
|---|---|
| Info | Overlay extracted: Overlay_748984c2.bin (156504 bytes) |
PE Layout
UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential