Benign Download

Trojan-GameThief.Win32.Nilage.qo

Detects an XORed URL in an executableEncoded content decoded: xor
SHA-2562c86b4e814a551900c1372b0a32fae050ca32bb04e9b455a59438d58f9bd8384
MaleculeMdTh

Evidence

Detects an XORed URL in an executable 0x12348–0x12408
⋯3 more rows
0x12378eb5f5e5b8be55dc3ffffffff07000000._^[..].........
0x12388687474703a2f2f00ffffffff01000000http://.........
0x123982f000000558bec81c4bcfbffff535657/...U........SVW
⋯7 more rows
Encoded content decoded: xor 0x13810–0x138f0
⋯3 more rows
0x13840204f4b2100000000ffffffff2e000000 OK!............
0x13850e8f4f4f0baafaff7f7f7aee7b0b1aeed................
0x13860f9ede1e9ece5f2aee3efedaef4f7afe1................
0x13870b0b0b1aff5f0e6e9ece5aee1f3f00000................
0x13880558becb96d0000006a006a004975f951U...m...j.j.Iu.Q
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.