PESCAN.IO - Analysis Report Valid Code |
|||||
| File Structure: | |||||
|
|||||
| Information: |
| Size: 83,50 KB SHA-256 Hash: 5FEBD563D870C20A5CD70EE05AE33E3564280D213A7469101A231C12D912B0A7 SHA-1 Hash: A6A2332BBEDCBA9FECD107BC00C7F5BB37A3EE56 MD5 Hash: 05EDF2D133609FEB6525006E6EA111DA Imphash: F34D5F2D4577ED6D9CEEC516C1F5A744 MajorOSVersion: 4 CheckSum: 00000000 EntryPoint (rva): 162DE SizeOfHeaders: 200 SizeOfImage: 1C000 ImageBase: 400000 Architecture: x86 ImportTable: 16284 Characteristics: 102 TimeDateStamp: 686BBB97 Date: 07/07/2025 12:20:39 File Type: EXE Number Of Sections: 3 ASLR: Enabled Section Names: .text, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI UAC Execution Level Manifest: asInvoker [Incomplete Binary or Compressor Packer - 28,50 KB Missing] |
| Sections Info: |
| Section Name | Flags | ROffset | RSize | VOffset | VSize |
|---|---|---|---|---|---|
| .text | 60000020 (Executable) | 200 | 14400 | 2000 | 142E4 |
| .rsrc | 40000040 | 14600 | 600 | 18000 | 4DE |
| .reloc | 42000040 | 14C00 | 200 | 1A000 | C |
| Description: |
| InternalName: XWormClient.exe OriginalFilename: XWormClient.exe FileVersion: 1.0.0.0 |
| Entry Point: |
| The section number (1) - (.text) have the Entry Point Information -> EntryPoint (calculated) - 144DE Code -> FF25002040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 • JMP DWORD PTR [0X402000] • ADD BYTE PTR [EAX], AL • ADD BYTE PTR [EAX], AL • ADD BYTE PTR [EAX], AL • ADD BYTE PTR [EAX], AL • ADD BYTE PTR [EAX], AL • ADD BYTE PTR [EAX], AL • ADD BYTE PTR [EAX], AL • ADD BYTE PTR [EAX], AL • ADD BYTE PTR [EAX], AL • ADD BYTE PTR [EAX], AL • ADD BYTE PTR [EAX], AL • ADD BYTE PTR [EAX], AL • ADD BYTE PTR [EAX], AL • ADD BYTE PTR [EAX], AL • ADD BYTE PTR [EAX], AL • ADD BYTE PTR [EAX], AL • ADD BYTE PTR [EAX], AL • ADD BYTE PTR [EAX], AL • ADD BYTE PTR [EAX], AL • ADD BYTE PTR [EAX], AL • ADD BYTE PTR [EAX], AL • ADD BYTE PTR [EAX], AL |
| Signatures: |
| Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler: |
| Compiler: Microsoft Visual .NET - (You can use a decompiler for this...) • AnyCPU: True • Version: v4.0 Detect It Easy (die) • PE: library: .NET(v4.0.30319)[-] • PE: compiler: VB.NET(-)[-] • PE: linker: Microsoft Linker(11.0)[EXE32] • Entropy: 5.97359 |
| Suspicious Functions: |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | GetModuleHandle | Retrieves a handle to the specified module. |
| Windows REG (UNICODE): |
| SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rebuilt string - SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| File Access: |
| XWormClient.exe mscoree.dll NTdll.dll SHCore.dll user32.dll avicap32.dll kernel32.dll Temp |
| File Access (UNICODE): |
| SbieDll.dll /shutdown.exe XWormClient.exe shutdown.exe powershell.exe schtasks.exe Temp |
| SQL Queries: |
| Select * from AntivirusProductdisplayName,NoneG |
| Interest's Words: |
| Encrypt Decrypt exec createobject attrib start cipher hostname shutdown systeminfo expand replace |
| Interest's Words (UNICODE): |
| Virus wscript exec powershell schtasks start shutdown schtask ping |
| Anti-VM/Sandbox/Debug Tricks (UNICODE): |
| SandBoxie Library - SbieDll.dll |
| URLs (UNICODE): |
| http://ip-api.com/line/?fields=hostingtrue |
| AV Services (UNICODE): |
| Antivirus name extract - (SecurityCenter2) |
| IP Addresses: |
| 14.0.0.0 |
| Strings/Hex Code Found With The File Rules: |
| • Rule Text (Unicode): WinAPI Sockets (send) • Rule Text (Ascii): File (GetTempPath) • Rule Text (Ascii): Encryption (CipherMode) • Rule Text (Ascii): Encryption (CreateDecryptor) • Rule Text (Ascii): Encryption (FromBase64String) • Rule Text (Ascii): Encryption (ICryptoTransform) • Rule Text (Ascii): Encryption (MD5CryptoServiceProvider) • Rule Text (Ascii): Encryption (Rijndael) • Rule Text (Ascii): Encryption (RijndaelManaged) • Rule Text (Ascii): Encryption (ToBase64String) • Rule Text (Ascii): Execution (ShellExecute) • Rule Text (Unicode): Keyboard Key ([ENTER]) • Rule Text (Unicode): Keyboard Key ([Tab]) • Rule Text (Unicode): Keyboard Key ([Shift]) • Rule Text (Unicode): Keyboard Key ([SPACE]) • Rule Text (Unicode): Keyboard Key ([WIN]) • Rule Text (Ascii): Malicious rerouting of traffic to an attacker-controlled site (Redirect) • Rule Text (Unicode): Technique used to circumvent security measures (Bypass) • EP Rules: Microsoft Visual C / Basic .NET • EP Rules: Microsoft Visual C++ 8 • EP Rules: Microsoft Visual C++ 8.0 • EP Rules: Microsoft Visual C v7.0 / Basic .NET • EP Rules: Microsoft Visual Studio .NET • EP Rules: .NET executable |
| Resources: |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \VERSION\1\0 | 180A0 | 254 | 146A0 | 540234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000000 | T.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \24\1\0 | 182F4 | 1EA | 148F4 | EFBBBF3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3822207374616E64616C6F6E65 | ...<?xml version="1.0" encoding="UTF-8" standalone |
| Intelligent String: |
| • 1.0.0.0 • XWormClient.exe • .QGo • \Log.tmp • schtasks.exe • [/create /f /RL HIGHEST /sc minute /mo 1 /tn " • C/create /f /sc minute /mo 1 /tn " • .lnk • powershell.exe • http://ip-api.com/line/?fields=hosting • SbieDll.dll • /shutdown.exe /f /s /t 0 • /shutdown.exe /f /r /t 0 • shutdown.exe -L • .ps1 • .bat • _CorExeMainmscoree.dll |
| Extra 4n4lysis: |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 58513 | 68,4331% |
| Null Byte Code | 21166 | 24,7544% |
© 2025 All rights reserved.