Benign Download

Trojan.Win32.Obfuscated.ufq

IsDebuggerPresent API name in PE stringsReferences the IsDebuggerPresent API
SHA-2560041f110229845060604e78c5d7d8a1dd5c6b5f12756a702137a258cd3837d13
MaleculeH(Po₂)Md(Bi)

Evidence

High-entropy read-only .rdata section 0x817c0–0x818a0
⋯3 more rows
0x817f000000000000000000000000000000000................
0x81800a0df0800b2df0800c0df0800d0df0800................
0x81810eadf080002e008000000000029e00800............)...
0x818203fe008004fe0080063e0080071e00800?...O...c...q...
0x818308be0080097e00800a7e00800b3e00800................
⋯7 more rows
References the IsDebuggerPresent API 0x83090–0x83210
⋯4 more rows
0x830d020656e6f75676820737061636520666f enough space fo
0x830e07220617267756d656e74730d0a000000r arguments.....
0x830f052363030320d0a2d20666c6f6174696eR6002..- floatin
0x831006720706f696e7420737570706f727420g point support
⋯6 more rows
0x831704572726f72210a0a50726f6772616d3aError!..Program:
0x83180200000002e6d697863727400456e636f ....mixcrt.Enco
0x831906465506f696e7465720000004b45524edePointer...KERN
0x831a0454c33322e444c4c000000004465636fEL32.DLL....Deco
⋯7 more rows
IsDebuggerPresent API name in PE strings 0x8ce4c–0x8cf1c
⋯3 more rows
0x8ce7c756c6546696c654e616d654100002f02uleFileNameA../.
0x8ce8c4973446562756767657250726573656eIsDebuggerPresen
0x8ce9c7400a9025265616446696c6500004f01t...ReadFile..O.
0x8ceac476574456e7669726f6e6d656e745374GetEnvironmentSt
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.