Benign Download

Trojan.Win32.Agent.sha

Detects an XORed URL in an executableEncoded content decoded: xor
SHA-25608903d7356fdef4c31d702b82190ceb706832a79acdc1f1c29a47dac832ebcef
MaleculeMdTh

Evidence

Encoded content decoded: xor 0x125c0–0x126a0
⋯3 more rows
0x125f000000000000000000000000000000000................
0x12600607c7c783227276c677f66263f3f3f6e`||x2''lg.f&???n
0x1261072266b6765266b66277863276c677f66r&kge&kf'xc'lg.f
0x12620277b7b267c707c00a1252000e0f71200'{{&|p|..% .....
0x1263062b7fb73160000000000000000000000b..s............
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.