Benign Download

Trojan-PSW.Win32.QQPass.css

Detects an XORed URL in an executable
SHA-256237179899d15e3ec587efdc98d4a97c254231551b1eb02d9573b05fa9bed2838
MaleculeTh

Evidence

Detects an XORed URL in an executable 0x44c0–0x4580
⋯3 more rows
0x44f05e5b59595dc30000ffffffff23000000^[YY].......#...
0x4500687474703a2f2f666c6173682e636869http://flash.chi
0x45106e6172656e2e636f6d2f69702f69702enaren.com/ip/ip.
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.