Benign Download

Trojan-Spy.Win32.Delf.vt

Detects an XORed URL in an executableEmbedded PE binary at file offset 0xb0f0 (~45056 bytes)

SHA-2561758b8c64e57a5800d7017e3a0c233034257d993a1bb81ce85169039b2f9f92e

MaleculeTh

Evidence

Embedded PE binary at file offset 0xb0f0 (~45056 bytes) 0xb0b0–0xb180

⋯3 more rows
0xb0e041004700450049004e0046004f000000A.G.E.I.N.F.O...
0xb0f04d5a50000200000004000f00ffff0000MZP.............
0xb100b80000000000000040001a0000000000........@.......
0xb11000000000000000000000000000000000................
⋯7 more rows

Detects an XORed URL in an executable 0xe714–0xe7d4

⋯3 more rows
0xe744c8edffffc3e9b2e7ffffebeb8be55dc3..............].
0xe7543c2020246e7b7b392d7a67666c6c657a<  $n{{9-zgfllez
0xe764373b397b392d7a2339220000ffffffff7;9{9-z#9"......
⋯7 more rows