XWorm PE Executable malware analysis – a3a211537a8d

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Detection

PeID

Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ 8.0 (DLL)Microsoft Visual C++ v6.0 DLL

2 malicious · 178 files

EXEa3a211537a8d412f9cbafac67ef79e4aXWorm

EXEOverlay_1eab2139.bin

EXE[Rebuild from dump]_166fea59.exeXWorm

Name	Value
Info	Overlay extracted: Overlay_1eab2139.bin (961240 bytes)

PE Layout UNKNWOWNsuspect

Memoryhuhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #2 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #3 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #4 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #5 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #6 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #7 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #8 URIsuspect

https:huhuhuhuhuhuhu

URLs in VB Code - #9 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #10 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #11 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #12 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #13 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #14 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #15 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #16 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #17 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #18 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #19 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #20 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #21 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #22 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #23 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #24 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #25 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #26 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #27 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #28 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #29 URIsuspect

https:huhuhuhuhuhuhu

URLs in VB Code - #30 URIsuspect

https:huhuhuhuhuhuhu

URLs in VB Code - #31 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #32 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #33 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #34 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #35 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #36 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #37 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #38 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #39 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #40 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #41 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #42 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #43 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #44 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #45 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential