xwormProtected.exe

First submission 2024-10-15 16:32:06

File details

File type: PE32 executable (GUI) Intel 80386, for MS Windows
Mime type: application/x-dosexec
File size: 1638.32 KB (1677640 bytes)
Compile time: 2024-10-15 10:08:21
MD5: 7e2087055a8ab78c0025757274549257
SHA1: efa42811180edcf632a8a51a3a20093f67b65745
SHA256: 4c8bd4a1bdada3e9ff3a8cdb69948484733842c099f7bac5fc22c1aff00edf00
Import Hash : e0e5cba487d80ef75c8cfd3e40cc6131
Sections 3 .text .data .rsrc
Directories 3 import resource security

File features detected

Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR

OSINT Enrichments

Virus Total: 36/77 VT report date: 2024-10-15 16:25:09
Malware Type 1 trojan
Threat Type 2 zusy hcmm

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXp://94.154.172.127/iobj/xwormProtected.exe VirusTotal Report 94.154.172.127 VirusTotal Report 2024-10-15 16:32:06

PE Sections 0 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0x18380c 1589248 48ca0b430983d7c5405ffda596c5f11951ce22c0 e7d419842e613ae1b3dc4ef469e0a02e
.data 0x185000 0x3d24 4096 1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d 620f0b67a91f7f74151bc5be745b7110
.rsrc 0x189000 0x10b18 69632 f22bfa8d3590a361a08fb127dc403027764b69d2 e4aa303c09e9e218758a01d864c41375

PE Resources 3

Name Language Sublanguage Offset Size Data
RT_ICON LANG_NEUTRAL SUBLANG_NEUTRAL 0x1890e8 67624
RT_GROUP_ICON LANG_NEUTRAL SUBLANG_NEUTRAL 0x199910 20
RT_VERSION LANG_GERMAN SUBLANG_GERMAN 0x199924 500

Meta infos 6

InternalName: acvm7qw909e
ProductVersion: 1.00
Translation: 0x0407 0x04b0
ProductName: Eamre_Cerqea
OriginalFilename: acvm7qw909e.exe
FileVersion: 1.00

File signature

MD5 SHA1 Block size Virtual Address
88473e8ab6b07059d4d938ec04f33cdb 8e611ec69e63018c68491b4c0a1c58a1374d07bd 10568 1667072

Strings analysis - File found

Autogen
C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Library
USER32.dll
KERNEL32.dll
MSVBVM60.DLL
VB5!6&VB6DE.DLL
VBA6.DLL

Strings analysis - Possible URLs found 12

http://crl.globalsign.com/root-r6.crl0G
http://ocsp.globalsign.com/codesigningrootr450F
https://www.globalsign.com/repository/0
http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
http://ocsp2.globalsign.com/rootr606
http://crl.globalsign.com/codesigningrootr45.crl0U
http://ocsp.globalsign.com/ca/gstsacasha384g40C
http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
http://crl.globalsign.com/ca/gstsacasha384g4.crl0
http://secure.globalsign.com/cacert/gstsacasha384g4.crt0

Import functions

Name Latest seen MD5
testingProtected.exe 2024-10-15 16:33:06 acb5119773d5585f9155c28f97fa6eb0