Hostile ^100% pe-machine-learning-dataset Download

35526

Unsigned, packed, embedded PE, W^X

Writable .text sectionEntry point in a writable RWX section

SHA-256357261dec0df75112b7ad19926edd64784e711bfa7108cd2afb49e230731e711

MaleculeO₂(As₃P)H₅(DbDsF₃Os₇Po)Md₄(Bi₇HePaSi)

Evidence

English function-word token "this" 0x0–0xe0

0x04d5a90000300000004000000ffff0000MZ..............
0x10b8000000000000004000000000000000........@.......
0x2000000000000000000000000000000000................
0x30000000000000000000000000e0000000................
0x400e1fba0e00b409cd21b8014ccd215468........!..L.!Th
0x5069732070726f6772616d2063616e6e6fis program canno
⋯9 more rows

Copy files (Windows API ANSI) 0x2fc0–0x30f0

⋯3 more rows
0x2ff000000000000000000000000000000000................
0x3000e4330000f4330000d2330000be330000.3...3...3...3..
0x3010ac3300009c3300008e33000080330000.3...3...3...3..
0x3020703300005e3300004c3300003a330000p3..^3..L3..:3..
0x30302a330000143300000433000000000000*3...3...3......
0x3040e8320000da320000c4320000bc320000.2...2...2...2..
0x3050b0320000a03200009232000084320000.2...2...2...2..
0x30606e320000583200003c3200004c320000n2..X2..<2..L2..
0x30700000000032340000523400006a340000....24..R4..j4..
0x308012340000000000008e34000098340000.4.......4...4..
⋯7 more rows

References the Windows debugger output API 0x3240–0x34e0

⋯7 more rows
0x32b065025365744576656e7400009602536ce.SetEvent....Sl
0x32c065657000f5014f757470757444656275eep...OutputDebu
0x32d067537472696e67410000e6014f70656egStringA....Open
0x32e04576656e74410000570044656c657465EventA..W.Delete
⋯9 more rows
0x33805b01526567436c6f73654b6579007101[.RegCloseKey.q.
0x33905265674f70656e4b657941005e015265RegOpenKeyA.^.Re
0x33a0674372656174654b6579410086015265gCreateKeyA...Re
0x33b06753657456616c756545784100007b01gSetValueExA..{.
⋯19 more rows

Opens a Windows kernel device handle 0x41d0–0x42a0

⋯3 more rows
0x4200574152455c54454e43454e5400000000WARE\TENCENT....
0x42105c5c2e5c514b65794372797074446576\\.\QKeyCryptDev
0x422069636530000000000100000000000000ice0............
0x423000000000000000000000000000000000................
⋯7 more rows

Writable and exe section (W^X violation) 0x5fa0–0x60d0

⋯5 more rows
0x5ff000000000000000000000000000000000................
0x6000558bec81ec8c00000064a13000000089U........d.0....
0x601045d8c745e800e20000c745c4433a5c36E..E......E.C:\6
0x6020c745c835373130c745cc6262362ec745.E.5710.E.bb6..E
⋯11 more rows