Hostile ^100% pe-machine-learning-dataset Download

1864

Packed dropper with embedded PE

High-entropy PE loader protects a writable entry regionBlank-named high-entropy executable section

SHA-25635ee59e920968221a60ed0bfe4d7b2745cba8ba6b2f57a336d9060f13af16510

MaleculeO₄(As₈C₂Er₃I)H₈(Cm₂DsF₂MgOs₄Po₃TiU)Md₅(Bi₁₂HePaSi)

Evidence

English function-word token "this" 0x0–0xe0

0x04d5a90000300000004000000ffff0000MZ..............
0x10b8000000000000004000000000000000........@.......
0x2000000000000000000000000000000000................
0x30000000000000000000000000f0000000................
0x400e1fba0e00b409cd21b8014ccd215468........!..L.!Th
0x5069732070726f6772616d2063616e6e6fis program canno
⋯9 more rows

x86 indirect call through a global pointer 0xfc7–0x1087

⋯3 more rows
0xff7000000000000000000558bec51515356.........U..QQSV
0x10078b350460400033db538d45f8506a048d.5.`@.3.S.E.Pj..
0x101745fc50ff7508895df8895dfcffd685c0E.P.u..]..].....
⋯7 more rows

Indirect call followed by a compare branch 0x1419–0x14d9

⋯3 more rows
0x14497df4ff151c6040006a02578bd86af853}....`@.j.W..j.S
0x1459ff151860400083f8ff750c53ff151460...`@....u.S...`
0x14694000e99e000000568b3504604000578d@......V.5.`@.W.
⋯7 more rows

Dynamic library loading via LoadLibraryA 0x5fd0–0x62c0

0x5fd000000000000000000000000000000000................
0x5fe000000000000000000000000000000000................
0x5ff000000000000000000000000000000000................
0x6000846f0000926f00009e6f0000aa6f0000.o...o...o...o..
0x6010c06f0000d66f0000e46f0000f66f0000.o...o...o...o..
0x60200470000010700000b2730000a0730000.p...p...s...s..
0x60308e7300007c7300006c7300005c730000.s..|s..ls..\s..
0x6040427300002c73000016730000a8700000Bs..,s...s...p..
0x6050b4700000c0700000d4700000e6700000.p...p...p...p..
0x6060f8700000087100001671000024710000.p...q...q..$q..
0x60703271000042710000507100005e7100002q..Bq..Pq..^q..
0x6080707100008471000098710000a4710000pq...q...q...q..
0x6090b4710000d0710000ea71000002720000.q...q...q...r..
0x60a01c72000032720000427200005c720000.r..2r..Br..\r..
0x60b06e7200007c7200008c72000096720000nr..|r...r...r..
0x60c0a2720000ae720000ba720000d0720000.r...r...r...r..
0x60d0e0720000ec72000006730000c4730000.r...r...s...s..
0x60e000000000020000800000000042700000............Bp..
0x60f034700000000000006e7000005a7000004p......np..Zp..
⋯6 more rows
0x61606f706c657457696e0000000000000000opletWin........
0x61705468652064726f706c65742077617320The droplet was 
0x6180756e61626c6520746f20636f6e6e6563unable to connec
⋯5 more rows
0x61e0c3194000436f724578697450726f6365[email protected]
0x61f0737300006d73636f7265652e646c6c00ss..mscoree.dll.
0x620072756e74696d65206572726f72200000runtime error ..
⋯12 more rows

Writable and exe section (W^X violation) 0x10fa0–0x110d0

⋯5 more rows
0x10ff000000000000000000000000000000000................
0x11000558bec83ec70538365d0008365f80083U....pS.e...e...
0x1101065d80033c0668945cc8365e0008365ece..3.f.E..e...e.
0x11020008365e4008365f400834ddcff8365d4..e...e...M...e.
⋯11 more rows