Benign Download

Trojan-Downloader.Win32.Swizzor.avf

IsDebuggerPresent API name in PE stringsReferences the IsDebuggerPresent API
SHA-256350a49c2df36de18dfafda2dbd1c32e9af1d3576987e1c25becef393d1b3cfcb
MaleculeH(Po₂)Md(Bi)

Evidence

High-entropy read-only .rdata section 0x2bfc0–0x2c150
⋯3 more rows
0x2bff000000000000000000000000000000000................
0x2c000a4d40300b8d40300c8d40300e2d40300................
0x2c010fcd4030018d503002ed5030044d50300............D...
0x2c02060d5030078d5030088d503009ed50300`...x...........
0x2c030b0d50300c4d5030000000000e7d50300................
⋯18 more rows
Execute shell command (ShellExecuteA) 0x2c1b8–0x2c428
⋯12 more rows
0x2c278efdf030003e003000de0030017e00300................
0x2c28835e0030051e0030061e0030071e003005...Q...a...q...
0x2c29885e0030091e00300a7e00300bbe00300................
0x2c2a8cde00300e5e0030005e1030015e10300................
⋯14 more rows
0x2c398000000003ee5030054e503006ae50300....>...T...j...
0x2c3a87ae50300000000000000000000000000z...............
0x2c3b80000000016bd4000245d42004d0a4200......@.$]B.M.B.
⋯7 more rows
IsDebuggerPresent API name in PE strings 0x3e033–0x3e103
⋯3 more rows
0x3e0634c6f636b5265736f7572636500002f02LockResource../.
0x3e0734973446562756767657250726573656eIsDebuggerPresen
0x3e0837400ca0252746c556e77696e64006b02t...RtlUnwind.k.
0x3e0934d756c746942797465546f5769646543MultiByteToWideC
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.