App exe Malware XWorm File Malware Analysis: a916b72f95566268aeca2298759b2018

Hash Type	Value	Action
MD5	a916b72f95566268aeca2298759b2018
SHA1	dc449a1a8200a1ced9ea6d681c4738700d6a015f
SHA256	1f833964e95405776234ba73738ca25360c43a54ed71030c978fdf56d1cf11ba
SHA512	36210c0be16498d7c41095b0841d0472ab5bd1afda5051fbbcf119117c3763686602b4a9d49d9954839d8c33047870bbdd470c9e29dfd628ff0eac8671a1618c
ImpHash	3e4ea5a76e68c74643536824830b0523

PE Analysis

Basic Information

▼

Image Base	`0x140000000`
Entry Point	`0x1400010f6`
Compilation Time	2024-02-05 17:08:29
Checksum	0x0004c384 (Actual: 0x0004c384)
OS Version	4.0
PEiD Signatures	`PE32+ executable (GUI) x86-64, for MS Windows`
Digital Signature	The PE file does not contain a certificate table.
Imports	3 libraries KERNEL32, msvcrt, USER32
Exports	0 functions
Resources	1 Resources
Sections	20 Sections

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	117,496 bytes	117,760 bytes	5.99 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_16BYTES`	`2CD28190633C61882FA57F64938C31EA`
`.data`	`0x0001e000`	53,136 bytes	53,248 bytes	7.44 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_32BYTES`	`A11F8630C0358F45BC706E364F929D9C`
`.rdata`	`0x0002b000`	8,576 bytes	8,704 bytes	5.24 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_32BYTES`	`8C0086192FF221A1362B3762C68A07FD`
`/4`	`0x0002e000`	4 bytes	512 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_4BYTES`	`BF619EAC0CDF3F68D496EA9344137E8B`
`.pdata`	`0x0002f000`	5,952 bytes	6,144 bytes	5.29 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_4BYTES`	`6A96851ED50B31A6600DB8C820C2963A`
`.xdata`	`0x00031000`	5,864 bytes	6,144 bytes	3.98 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_4BYTES`	`FE56ED9C1D64D839FFDD4ED898BB8057`
`.bss`	`0x00033000`	3,440 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_UNINITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_32BYTES`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x00034000`	4,104 bytes	4,608 bytes	4.10 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_4BYTES`	`D773DF2B0D4FFE980D8352EA31C0434A`
`.CRT`	`0x00036000`	112 bytes	512 bytes	0.43 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_8BYTES`	`A3453752D96B07DF53CED805F3DF1BC0`
`.tls`	`0x00037000`	16 bytes	512 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_8BYTES`	`BF619EAC0CDF3F68D496EA9344137E8B`
`.rsrc`	`0x00038000`	552 bytes	1,024 bytes	3.41 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_4BYTES`	`BFA1C04600A1C8B2E8C1FC6B14F6DD19`
`.reloc`	`0x00039000`	216 bytes	512 bytes	2.51 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_4BYTES`	`3011FB66F84AF6CB9307D0D7CAC632D6`
`/14`	`0x0003a000`	144 bytes	512 bytes	0.54 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_16BYTES`	`DE13DBF0BB46F986C063D4848CD1F2B5`
`/29`	`0x0003b000`	9,944 bytes	10,240 bytes	5.61 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_1BYTES`	`BB0C1B9FC5CE9C2912FF24F2523CC181`
`/41`	`0x0003e000`	1,090 bytes	1,536 bytes	3.97 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_1BYTES`	`445310D78317DFE90942A16CF6CD9A00`
`/55`	`0x0003f000`	1,314 bytes	1,536 bytes	4.83 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_1BYTES`	`5FB3B4400A9ED9DBD8C73BAF4BADE3A6`
`/67`	`0x00040000`	448 bytes	512 bytes	2.95 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_8BYTES`	`FF49B236E696D0F3F554F8D2714E9603`
`/80`	`0x00041000`	132 bytes	512 bytes	2.02 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_1BYTES`	`E647DC8783FC2F6F90F3541C4DB762C0`
`/91`	`0x00042000`	945 bytes	1,024 bytes	4.18 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_1BYTES`	`60F8D74B656D5D047E4471243008977B`
`/107`	`0x00043000`	170 bytes	512 bytes	1.64 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_1BYTES`	`B8FCD785A65F6FEE8172BACF46FEFF32`

Entropy Analysis Alert

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 1 (458 bytes)

Resource Type	Count	Total Size	Percentage
RT_MANIFEST	1	458 bytes	100%

Certificate Chain Analysis

▼

No Digital Signatures

This file is not digitally signed.

Security Implications:

Cannot verify the publisher's identity
Increased security risk when running this file
May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

The PE file does not contain a certificate table.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

File Name	app.exe
File Type	PE32+ executable (GUI) x86-64, for MS Windows
Scanner Version	1.0.165.174
Database Version	2024-02-17 03:00:21 UTC

App.exe Malware XWorm Analysis

Technical Analysis

Malware.Win64.XWorm.tr

Scan Another File

File Identification