Suspicious 80% pe-machine-learning-dataset Download

337895

Opaque name, packed, anti-debug

Binary contains high-entropy data regionsModify memory page protection
SHA-25616eea77c10930fee513d82de5f02907aa4beeb237266dfbd054c359e4e4a0042

Evidence

Single section dominates file 0x3c0–0x670
⋯3 more rows
0x3f000000000000000000000000000000000................
0x400558bec51837d140f5356577d1a6a0068U..Q.}..SVW}.j.h
0x410606153006a00ff150461530085c07507`aS.j....aS...u.
0x420c7451450f513006a00ff150460530003.E.P...j....`S..
0x43045148945148d45fc508b45146a4068a8E..E..E.P.E.j@h.
0x44009000050ff1500605300909090909090...P...`S.......
0x45090909090909090909090909090909090................
0x46090909090909090909090909090909090................
0x47090909090909090909090909090909090................
0x48090909090909090909090909090909090................
0x49090909090909090909090909090909090................
0x4a090909090909090909090909090909090................
0x4b090909090909090909090909090909090................
0x4c090909090909090909090909090909090................
0x4d090909090909090909090909090909090................
0x4e090909090909090909090909090909090................
0x4f090909090909090909090909090909090................
0x50090909090909090909090909090909090................
0x51090909090909090909090909090909090................
0x52090909090909090909090909090909090................
0x53090909090909090909090909090909090................
0x54090909090909090909090909090909090................
0x55090909090909090909090909090909090................
0x56090909090909090909090909090909090................
0x57090909090909090909090909090909090................
0x58090908b451468a809000050e820000000...E.h....P. ...
0x59083c4088b4d14515350938d1507b64000....M.QSP.....@.
0x5a0ff54240833c05f5e5b8be55dc21000cc.T$.3._^[..]....
0x5b0558bec83ec288b4d0c0f100564615300U....(.M....daS.
0x5c0a07461530053c1e903c745ec0c76634a.taS.S....E..vcJ
0x5d0894d0c8845e856570f1145d885c90f84.M..E.VW..E.....
0x5e0f70000008b4d08660f1f840000000000.....M.f........
0x5f08b198b4104c745fc80c16e4c895df8c7...A..E...nL.]..
0x60045f4200000008b55fc8bf3c1ee058bcbE. ....U........
0x6100375e403d3c1e104034de033f133f22b.u.......M.3.3.+
0x620c68945f0909090909090909090909090..E.............
0x63090909090909090909090909090909090................
0x64090909090909090909090909090909090................
0x65090909090909090909090909090909090................
0x66090909090909090909090909090909090................
0x67090909090909090909090909090909090................
Inline MZ header validation constant 0xa48–0xb18
0xa488945f48945f88945fca5a5a5bf98c753.E..E..E.......S
0xa58008945f48945f88d75f48945fcb001a5..E..E..u..E....
0xa68a5a55f5e8be55dc36a05e838020000cc.._^..].j..8....
0xa786a086838ad5300e82c0400008365fc00j.h8.S..,....e..
0xa88b84d5a000066390500004000755da13c[email protected]].<
0xa9800400081b80000400050450000754cb9.@[email protected].
0xaa80b01000066398818004000753e8b4508[email protected]>.E.
0xab8b9000040002bc15051e869feffff5959...@.+.PQ.i...YY
0xac885c07427837824007c21c745fcfeffff..t'.x$.|!.E....
0xad8ffb001eb1f8b45ec8b0033c981380500......E...3..8..
0xae800c00f94c18bc1c38b65e8c745fcfeff.........e..E...
0xaf8ffff32c0e8f5030000c3558bece89b05..2.......U.....
0xb08000085c0740f807d0800750933c0b988....t..}..u.3...
0xb18c7530087015dc3558bec803da4 .S...].U...=.
x86 indirect call through a global pointer 0x129f–0x135f
0x129f188945f085c974658d5610e88f030000..E...te.V......
0x12afb101884dff85c078667e558b45088138...M...xf~U.E..8
0x12bf63736de07537833da4d2530000742e68csm.u7.=..S..t.h
0x12cfa4d25300e84885000083c40485c0741a..S..H........t.
0x12df8b35a4d253008bce6a01ff7508e8b7fb.5..S...j..u....
0x12efffffffd68b750c83c4088b45088bd08b.....u.....E....
0x12ffcee869030000397e0c746ceb588a4dff..i...9~.tl.X.M.
0x130f8bfb83fbfe74148b5df8e973ffffff8b.....t..]..s....
0x131f5df8c745f400000000eb2484c9742c8b]..E......$..t,.
0x132f5df8eb1b837e0cfe74216818c053008d]....~..t!h..S..
0x133f4610bafeffffff508bcee839030000ffF......P...9....
0x134f75ec53e899feffff83c4088b45f45f5eu.S.........E._^
0x135f5b8be55dc36818c053008d [..].h..S..
In-code MZ/PE compare immediate 0x247f–0x258f
0x247fff7508e82a0000008b45ec8b00ff30e8.u..*....E....0.
0x248ff2feffff83c404c38b65e8e846080000.........e..F...
0x249f8b75106a02e84421000059c3e8597500.u.j..D!..Y..Yu.
0x24af00c38bff558bece82725000084c07420....U...'%....t
0x24bf64a1300000008b4068c1e808a8017510[email protected].
0x24cfff7508ff153860530050ff153c605300.u...8`S.P..<`S.
0x24dfff7508e84f00000059ff7508ff158c60.u..O...Y.u....`
0x24ef5300cc6a00ff15046053008bc885c975S..j....`S.....u
0x24ff0332c0c3b84d5a000066390175f38b41.2...MZ..f9.u..A
0x250f3c03c181385045000075e6b90b010000<...8PE..u......
0x251f6639481875db8378740e76d583b8e800f9H.u..xt.v.....
0x252f0000000f95c0c38bff558bec5151a118.........U..QQ..
0x253fc0530033c58945fc8365f8008d45f850.S.3..E..e...E.P
0x254f68946a53006a00ff159060530085c074h.jS.j....`S...t
0x255f235668ac6a5300ff75f8ff1570605300#Vh.jS..u...p`S.
0x256f8bf085f6740dff75088bceff150c6153....t..u......aS
0x257f00ffd65e837df8007409ff75f8ff156c...^.}..t..u...l
0x258f6053008b4dfc33cde8 `S..M.3..
Dense api-ms-win-core string cluster 0x134964–0x134a74
⋯3 more rows
0x13499476006100700069003300320000000000v.a.p.i.3.2.....
0x1349a46100700069002d006d0073002d007700a.p.i.-.m.s.-.w.
0x1349b469006e002d0063006f00720065002d00i.n.-.c.o.r.e.-.
0x1349c46600690062006500720073002d006c00f.i.b.e.r.s.-.l.
0x1349d431002d0031002d0031000000610070001.-.1.-.1...a.p.
0x1349e469002d006d0073002d00770069006e00i.-.m.s.-.w.i.n.
0x1349f42d0063006f00720065002d0073007900-.c.o.r.e.-.s.y.
0x134a046e00630068002d006c0031002d003200n.c.h.-.l.1.-.2.
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.