Suspicious 80% Download

Trojan-Spy.Win32.Agent.crs

Named Trojan, W^X violation

Writable .text sectionEntry point in a writable RWX section
SHA-256050f8637d94767f2ec2dba7dc8a07cc0dffdf069a2957d0af9f9a6cd915865de
MaleculeO(As)Md₃(Bi₂Si)

Evidence

Entry point in a writable RWX section 0x0–0xe0
0x04d5a90000300000004000000ffff0000MZ..............
0x10b8000000000000004000000000000000........@.......
0x2000000000000000000000000000000000................
0x30000000000000000000000000d0000000................
⋯11 more rows
Writable .text section 0xfa0–0x10e0
⋯5 more rows
0xff000000000000000000000000000000000................
0x100070040604f40406045004060403040604p.......P.......
0x101094040604c0040604ec04060404040404................
0x1020c70404030c0404030404040439040403............9...
0x1030e3040403a90404030c040403e1040403................
⋯11 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.