Benign Download

Trojan.Win32.Obfuscated.qww

IsDebuggerPresent API name in PE stringsReferences the IsDebuggerPresent API

SHA-25647ba5936751309924631709785a6fec28d7f2443787e06a8f5500f0be5cb4059

Evidence

High-entropy read-only .rdata section 0x56bc0–0x56ca0

⋯3 more rows
0x56bf000000000000000000000000000000000................
0x56c0068e305007ae305008ee30500a0e30500h...z...........
0x56c10b6e30500c4e30500e2e30500f4e30500................
0x56c2000e4050016e4050026e4050030e40500........&...0...
0x56c3040e4050054e4050066e405007ae40500@...T...f...z...
⋯7 more rows

References the IsDebuggerPresent API 0x580b8–0x581e8

⋯3 more rows
0x580e8976e456c1a94dcf406ce73995ee87790.nEl......s.^.w.
0x580f85b0a3da053caa79ee335909c54caa31c[.=.S....5..T...
0x58108a67befcab54b7771b83dc0330572e87f.{...Kwq.=.3.r..
0x58118a80297dc7935f80a3fdc36856f0e120a....y5..?.6.o...
0x581285feb13f63433db36604139720cd5858a_...43.6`A9r....
0x58138444630b79482c458dc22f67a0568c282DF0....X.".z.h..
0x581480832b7f3ce4af6e1732f057e2be44c67.2...J..s/.~+.Lg
0x581588fd30e09cb84fbcab0fc277d73cd5baf..........'}s.[.
0x581688f6c65603e6981ab1f19b7a6a0a6d5e2.le`>i..........
0x5817803c3bfd8b002ab87dbf50a1d39c2d738............9..8
⋯7 more rows

IsDebuggerPresent API name in PE strings 0x5d3ac–0x5d47c

⋯3 more rows
0x5d3dc4765745469636b436f756e7400002f02GetTickCount../.
0x5d3ec4973446562756767657250726573656eIsDebuggerPresen
0x5d3fc74003400436f6d70617265537472696et.4.CompareStrin
0x5d40c674100003d0147657443757272656e74gA..=.GetCurrent
⋯7 more rows