Benign Download

Trojan-Downloader.Win32.Agent.kfj

Detects an XORed URL in an executableEncoded content decoded: xor
SHA-2561b274ef17fc5c7f12d19d7826c0995f02d3e2d9889b79d5bd6b762ce484e4423
MaleculeMdTh

Evidence

Detects an XORed URL in an executable 0x4285–0x4345
⋯3 more rows
0x42b5f08bc35e5b595dc3ffffffff07000000...^[Y].........
0x42c5687474703a2f2f00ffffffff01000000http://.........
0x42d57b000000ffffffff010000007d000000{...........}...
⋯7 more rows
Encoded content decoded: xor 0x73c0–0x7420
⋯3 more rows
0x73f000000000000000000000000000000000................
0x74006478787c3623237d7d22353c3f393a22dxx|6##}}"5<?9:"
0x74106f6361226f622338386b612368603c3foca"ob#88ka#h`<?
0x7420223c3e227874782a457a614d "<>"xtx*EzaM

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.