Hostile ^100% pe-machine-learning-dataset Download

41809

Packed dropper with embedded PE

High-entropy PE loader protects a writable entry regionBlank-named high-entropy executable section

SHA-256467e9ce49a435581269cca5f41d44f4958dd4e4fef95243dd5f9a700d98bc018

MaleculeO(As₅)H₉(Cm₄Db₂DsF₁₀Hf₂Mg₂Os₆Po₇U)Md₄(Bi₉HePaSi)

Evidence

English function-word token "this" 0x0–0xe0

0x04d5a90000300000004000000ffff0000MZ..............
0x10b8000000000000004000000000000000........@.......
0x2000000000000000000000000000000000................
0x3000000000000000000000000018010000................
0x400e1fba0e00b409cd21b8014ccd215468........!..L.!Th
0x5069732070726f6772616d2063616e6e6fis program canno
⋯9 more rows

Dynamic library loading via LoadLibraryA 0x56fc8–0x57218

0x56fc800000000000000000000000000000000................
0x56fd800000000000000000000000000000000................
0x56fe800000000000000000000000000000000................
0x56ff80000000000000000682506002c2f0600........h%..,/..
0x57008342506004625060026250600582506004%..F%..&%..X%..
0x5701800000000a62506000000000096260600.....%.......&..
0x5702800000000922406009e240600ae240600.....$...$...$..
0x57038c8240600d6240600e62406007e240600.$...$...$..~$..
0x5704804250600722406006624060052240600.%..r$..f$..R$..
0x570583c240600242406001624060000240600<$..$$...$...$..
0x57068f0230600e62306001a2f0600022f0600.#...#.../.../..
0x57078f42e0600e22e0600f2240600d8230600.........$...#..
0x57088d62e0600c8230600000000003c2e0600.....#......<...
0x57098242e06000c2e0600f42d0600e22d0600$........-...-..
0x570a8c42d0600b42d0600a02d0600922d0600.-...-...-...-..
0x570b8802d06006e2d06005a2d06004e2d0600.-..n-..Z-..N-..
0x570c83c2d0600302d06001a2d0600a8200600<-..0-...-... ..
0x570d8922006007c2006006420060052200600. ..| ..d ..R ..
0x570e83a2006002220060006200600ec1f0600: .." ... ......
0x570f8de1f0600ce1f0600be1f0600a61f0600................
0x571088a1f06007c1f06006c1f0600601f0600....|...l...`...
0x57118441f06002c1f0600141f0600fe1e0600D...,...........
0x57128ea1e0600d41e0600be1e0600b61e0600................
0x571389e1e06008e1e06007e1e06006c1e0600........~...l...
0x571485e1e0600042d0600f02c0600e02c0600^....-...,...,..
0x57158d42c0600c82c0600be2c0600aa2c0600.,...,...,...,..
0x57168942c06007e2c0600722c0600642c0600.,..~,..r,..d,..
0x57178562c0600462c0600362c0600282c0600V,..F,..6,..(,..
0x571881a2c0600082c0600fa2b0600ec2b0600.,...,...+...+..
0x57198d62b0600c62b0600b62b0600a62b0600.+...+...+...+..
0x571a8942b0600882b06007c2b0600302e0600.+...+..|+..0...
0x571b8000000001e080080be18008047180080............G...
⋯6 more rows

Native strtok delimiter parser import 0x576b8–0x579a8

⋯3 more rows
0x576e8861d0600781d0600621d0600581d0600....x...b...X...
0x576f84e1d0600441d0600361d0600281d0600N...D...6...(...
0x577081a1d06000c1d0600001d0600642b0600............d+..
0x57718f61c0600ee1c0600e41c0600da1c0600................
0x57728d01c0600c61c0600be1c0600b61c0600................
0x57738ac1c0600a21c0600981c0600901c0600................
0x57748881c0600801c0600761c06006a1c0600........v...j...
0x57758561c06004a1c0600421c0600361c0600V...J...B...6...
0x57768221c0600181c06003a2b0600442b0600".......:+..D+..
0x577784e2b0600621c0600ca290600d4290600N+..b....)...)..
0x57788e0290600ee290600f6290600fe290600.)...)...)...)..
0x57798062a0600102a06001a2a0600242a0600.*...*...*..$*..
0x577a82e2a06003a2a0600442a06004c2a0600.*..:*..D*..L*..
0x577b8542a06005c2a0600642a06006c2a0600T*..\*..d*..l*..
0x577c8762a0600802a0600882a0600922a0600v*...*...*...*..
0x577d89c2a0600a62a0600b02a0600ba2a0600.*...*...*...*..
0x577e8c42a0600ce2a0600d82a0600e62a0600.*...*...*...*..
0x577f8f02a0600fa2a0600062b0600102b0600.*...*...+...+..
0x578081a2b0600242b0600582b060000000000.+..$+..X+......
0x5781802000080010000800300008000000000................
0x5782806000080000000003e2f06008a250600........>/...%..
0x57838000000001e2106002e2106003e210600.....!...!..>!..
0x5784856210600662106007221060080210600V!..f!..r!...!..
0x5785890210600a0210600aa210600be210600.!...!...!...!..
0x57868ce210600da210600e2210600f0210600.!...!...!...!..
0x57878022206000e2206001a22060028220600."..."..."..("..
0x5788834220600422206004e2206005c2206004"..B"..N"..\"..
0x578986e2206007c2206008822060094220600n"..|"..."..."..
0x578a80e210600b4220600c4220600d6220600.!..."..."..."..
0x578b8e8220600f42206000423060010230600."..."...#...#..
0x578c81e230600342306004223060052230600.#..4#..B#..R#..
0x578d84c2e06005c2e0600682e06007c2e0600L...\...h...|...
0x578e88c2e06009e2e0600b02e0600c42e0600................
0x578f85e2306006a2306007823060088230600^#..j#..x#...#..
0x579089e230600b0230600ee200600fc200600.#...#... ... ..
0x57918c8200600d8200600a02206004a210600. ... ..."..J!..
0x5792800000000702606005a26060048260600....p&..Z&..H&..
0x57938000000000c0000800800008034000080............4...
0x57948390000800f0000800e000080090000809...............
0x57958000000001a2906002e29060040290600.....)...)..@)..
0x57968522906006a2906003e27060008290600R)..j)..>'...)..
⋯4 more rows

References the Windows debugger output API 0x61e3e–0x6203e

⋯7 more rows
0x61eae696c65496e7441009602536c65657000ileIntA...Sleep.
0x61ebef5014f75747075744465627567537472..OutputDebugStr
0x61ece696e6741000024014765744d6f64756cingA..$.GetModul
0x61ede6546696c654e616d6541000026014765eFileNameA..&.Ge
⋯12 more rows
0x61fae437269746963616c53656374696f6e00CriticalSection.
0x61fbe2c02526573756d655468726561640000,.ResumeThread..
0x61fce4a004372656174655468726561640000J.CreateThread..
⋯7 more rows

Writable and exe section (W^X violation) 0x75fa0–0x760d0

⋯5 more rows
0x75ff000000000000000000000000000000000................
0x76000558bec83ec70538365d0008365f80083U....pS.e...e...
0x7601065d80033c0668945cc8365e0008365ece..3.f.E..e...e.
0x76020008365e4008365f400834ddcff8365d4..e...e...M...e.
⋯11 more rows