Suspicious 80% Download

Trojan-Dropper.Win32.Delf.cvi

Trojan dropper with embedded PE

Binary contains a UPX packing markerUPX decompression I/O error
SHA-2561b5d28bf848053f7ba2fcb6ac36ee35cee2dfddd00e99cedcac55b9276d3ffc4
MaleculeH(Po₂)Md(Bi)

Evidence

High-entropy UPX1 packed payload section 0x3c0–0x490
⋯3 more rows
0x3f0dc930000011300000030000026000066.........0..&..f
0x40020836cffff25a85040008bc007a4a083 .l..%.P@.......
0x4100c32c89c9894900c32c8208c888432c8.2......2. ...2.
0x4202083807c78c820830c74706c20830c32 ..|x. ..tpl ..2
⋯7 more rows
Embedded PE binary at file offset 0x2200 (~15888 bytes) 0x21c0–0x2290
⋯3 more rows
0x21f000000000000000000000000000000000................
0x22004d5a90000300000004000000ffff0000MZ..............
0x2210b8000000000000004000000000000000........@.......
0x222071000000000000000000000000000000q...............
⋯7 more rows
IsDebuggerPresent API name in PE strings 0x4892–0x4962
⋯3 more rows
0x48c2436c6f736548616e646c650000000000CloseHandle.....
0x48d24973446562756767657250726573656eIsDebuggerPresen
0x48e274000000000000000000000000000000t...............
0x48f2000000000000000000000000000000e8................
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.