Hostile ^100% pe-machine-learning-dataset Download

55328

Packed dropper with embedded PE

Parasitic entrypoint drops an embedded PEResolves temp-file write and execution APIs

SHA-2562c89bc66772be192813e793561656c00e5621eb7777a58995b85517f6fe52750

MaleculeO₂(C₂As₃)H₇(Cm₂DbDsFOs₅Po₂Ti)Md₄(Bi₇PaSi)

Evidence

English function-word token "this" 0x0–0xe0

0x04d5a90000300000004000000ffff0000MZ..............
0x10b8000000000000004000000000000000........@.......
0x2000000000000000000000000000000000................
0x3000000000000000000000000000010000................
0x400e1fba0e00b409cd21b8014ccd215468........!..L.!Th
0x5069732070726f6772616d2063616e6e6fis program canno
⋯9 more rows

Dynamic library loading via LoadLibraryA 0x4dfc4–0x4e284

⋯3 more rows
0x4dff4000000000000000000000000ea7c0500.............|..
0x4e004d87c0500c47c0500f87c050000000000.|...|...|......
0x4e014d8820500c6820500b08205009a820500................
0x4e02430790500407905004e79050064790500[email protected]..
0x4e034827905009a790500b8790500d6790500.y...y...y...y..
0x4e044e6790500f8790500167a05002c7a0500.y...y...z..,z..
0x4e054467a0500527a0500627a0500707a0500Fz..Rz..bz..pz..
0x4e064787a05008c7a05009c7a0500b27a0500xz...z...z...z..
0x4e074c67a0500de7a0500ea820500fc7a0500.z...z.......z..
0x4e084107b0500307b05003c7b05005c7b0500.{..0{..<{..\{..
0x4e0947a7b05008c7b05009c7b0500aa7b0500z{...{...{...{..
0x4e0a4be7b0500d67b0500ec7b0500fa7b0500.{...{...{...{..
0x4e0b40c7c05008e8205008482050076820500.|..........v...
0x4e0c46a820500568205004682050034820500j...V...F...4...
0x4e0d42282050010820500fe810500e8810500"...............
0x4e0e4fc8205001a8305002a830500ee7a0500........*....z..
0x4e0f4e27d0500d2810500c0810500ae810500.}..............
0x4e1049e810500928105008481050072810500............r...
0x4e11458810500807d0500907d0500a07d0500X....}...}...}..
0x4e124b07d0500ca7d05003c830500fa7d0500.}...}..<....}..
0x4e1340a7e05001a7e0500307e05003e7e0500.~...~..0~..>~..
0x4e1444c7e0500587e0500707e05008a7e0500L~..X~..p~...~..
0x4e1549a7e0500ac7e0500c67e0500de7e0500.~...~...~...~..
0x4e164f27e0500047f0500127f0500207f0500.~.......... ...
0x4e174347f0500487f05005e7f05006c7f05004...H...^...l...
0x4e184827f05009e7f0500b67f0500ce7f0500................
0x4e194e67f0500f27f0500fe7f05000a800500................
0x4e1a418800500268005003680050050800500....&...6...P...
0x4e1b4608005006e8005007c80050092800500`...n...|.......
0x4e1c4a2800500b2800500be800500ce800500................
0x4e1d4dc800500f88005000c81050026810500............&...
0x4e1e44081050000000000147d050000000000@........}......
0x4e1f45e7d050000000000547c0500467c0500^}......T|..F|..
0x4e2043a7c05002c7c0500a87c0500947c0500:|..,|...|...|..
0x4e214807c0500727c0500627c050000000000.|..r|..b|......
0x4e224367d0500000000000f000080340000806}..........4...
0x4e23473000080740000803900008006000080s...t...9.......
⋯5 more rows

Percent-encoded content decoded 0x54adc–0x54bac

⋯3 more rows
0x54b0c2e0a0000ffffffff0000000051064301............Q.C.
0x54b1c6d656d6f727920636865636b20657272memory check err
0x54b2c6f7220617420307825303858203d2030or at 0x%08X = 0
0x54b3c78253032582c2073686f756c64206265x%02X, should be
⋯7 more rows

Microsoft Visual C++ debug runtime 0x551d8–0x55318

⋯3 more rows
0x55208410000007573657233322e646c6c0000A...user32.dll..
0x552184d6963726f736f66742056697375616cMicrosoft Visual
0x5522820432b2b204465627567204c69627261 C++ Debug Libra
0x55238727900004465627567202573210a0a50ry..Debug %s!..P
0x55248726f6772616d3a202573257325732573rogram: %s%s%s%s
0x5525825732573257325732573257325730a0a%s%s%s%s%s%s%s..
0x5526828507265737320526574727920746f20(Press Retry to 
0x55278646562756720746865206170706c6963debug the applic
0x552886174696f6e2900000a4d6f64756c653aation)...Module:
0x55298200000000a46696c653a20000a4c696e ....File: ..Lin
0x552a8653a20000a0a00004578707265737369e: .....Expressi
0x552b86f6e3a20000000000a0a466f7220696eon: ......For in
0x552c8666f726d6174696f6e206f6e20686f77formation on how
⋯5 more rows

Resolves temp-file write and execution APIs 0x60fa0–0x61290

⋯5 more rows
0x60ff000000000000000000000000000000000................
0x61000558bec81ec6c01000033c05356578945U....l...3.SVW.E
0x61010dc8945f08945ec8945f88945f48945e0..E..E..E..E..E.
0x610208945e8c745b85a487551c745bc747371.E..E.ZHuQ.E.tsq
0x610302ec745c065786500c745c400000000e8..E.exe..E......
0x61040000000005805250200008945fc64a130....X.%....E.d.0
0x610500000008945d88b45fcc70083c404e98b....E..E........
0x6106045fcc74004df8aecfd8b45d88b400c8b[email protected]..@..
0x61070401c8b008b40088b483c8b4c017803c8@[email protected]<.L.x..
⋯8 more rows
0x611003332c745a02e646c6cffd6e967ffffff32.E..dll...g...
0x6111081f957696e457511817a047865630075..WinEu..z.xec.u
0x61120088975f4e99200000081f9436c6f7375..u........Closu
0x6113017817a046548616e750e817a08646c65..z.eHanu..z.dle
0x611400075058975f8eb7381f9577269747517.u..u..s..Writu.
0x61150817a046546696c750e0fb74a0883f965.z.eFilu...J...e
0x6116075058975eceb548b0a81f94372656175u..u..T....Creau
0x6117017817a0474654669750e817a086c6541..z.teFiu..z.leA
0x611800075058975f0eb3381f9476574547517.u..u..3..GetTu.
0x61190817a04656d7050750e817a0861746841.z.empPu..z.athA
⋯8 more rows
0x61220ffff50ff55f08bf083feff74388b45fc..P.U......t8.E.
0x6123033c981384d5a9000740c404181f9f4013..8MZ..t.@A....
0x6124000007ceeeb0f578d4dd45168003e0000..|...W.M.Qh.>..
0x612505056ff55ec56ff55f86a058d8594feffPV.U.V.U.j......
0x61260ff50ff55f45f5e5bc9c300575457543a.P.U._^[...WTWT:
0x61270094d5a90000300000004000000ffff00.MZ.............
0x6128000b80000000000000040000000000000.........@......
0x6129000000000000000000000000000000000................