Benign Download

Hoax.Win32.Agent.du

Detects an XORed URL in an executableEncoded content decoded: xor
SHA-256484f9362f377321639393c1446d192235dd42756a32027cc81d237d14d73617b
MaleculeMdTh

Evidence

Encoded content decoded: xor 0x1923–0x1a33
⋯3 more rows
0x1953657457696e646f77546578744100003fetWindowTextA..?
0x1963025472616e736c617465416363656c65.TranslateAccele
0x19737261746f72410042025472616e736c61ratorA.B.Transla
0x198374654d65737361676500007573657233teMessage..user3
0x1993322e646c6c00001900436c656172436f2.dll....ClearCo
0x19a36d6d4572726f7200001a00436c6f7365mmError....Close
0x19b348616e646c65002500436f707946696cHandle.%.CopyFil
0x19c365457841002600436f707946696c6545eExA.&.CopyFileE
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.