27553
Packed dropper with embedded payload
Unsigned Microsoft-branded PE with custom RWX loader sectionEntry point in a writable RWX section
SHA-25649e8fc685361a4fdf939e046a041d69ef7e890234316a7f1a4546c7dde0f3a02
Evidence
0x04d5a90000300000004000000ffff0000MZ..............
0x10b8000000000000004000000000000000........@.......
0x2000000000000000000000000000000000................
0x30000000000000000000000000d8000000................
0x400e1fba0e00b409cd21b8014ccd215468........!..L.!Th
0x5069732070726f6772616d2063616e6e6fis program canno
⋯9 more rows
⋯3 more rows
0xff4000000000000000000000000ece70000................
0x10044ce8000042e800002ee800001ae80000L...B...........
0x10140ae80000fae700000000000070e90000............p...
0x10247ee9000058e900008ae9000098e90000~...X...........
0x1034a4e90000b6e90000c6e90000d6e90000................
0x104440e900000cea00001cea000034ea0000@...........4...
0x1054f4e9000060ea000074ea000084ea0000....`...t.......
0x106494ea0000a2ea0000b0ea0000beea0000................
0x1074e2e900004cea0000f0ea000000eb0000....L...........
0x1084ccea00002ceb000042eb000058eb0000....,...B...X...
0x10946ceb000080eb000096eb0000aceb0000l...............
0x10a4bceb0000deea000016eb0000a2e40000................
0x10b4cceb0000e4eb0000c2e40000b2e40000................
0x10c424e9000004e50000fceb00000ae90000$...............
0x10d40cec000018ec000024ec000038ec0000........$...8...
0x10e44cec00005cec00006cec00007cec0000L...\...l...|...
0x10f49aec0000b8ec0000d4ec0000f0ec0000................
0x110402ed000014ed000020ed000032ed0000........ ...2...
0x111440ed000052ed000062ed000078ed0000@...R...b...x...
0x11248aed0000a4ed0000baed0000cced0000................
0x1134e0ed0000f0ed000004ee000014ee0000................
0x114420ee000030ee000046ee0000c6e80000 ...0...F.......
0x1154f2e80000d6e80000bce80000aee80000................
0x1164a0e8000076e8000090e8000084e80000....v...........
0x1174f6e40000d2e40000e0e400001ae50000................
0x118494e4000026e5000038e5000048e50000....&...8...H...
0x119454e5000060e500006ce5000066f20000T...`...l...f...
0x11a47af20000000000000200008006000080z...............
0x11b40000000048f10000000000007ce70000....H.......|...
0x11c40000000018e7000004e7000026e70000............&...
0x11d44ce7000058e7000066e7000034e70000L...X...f...4...
0x11e4aae60000c6e600009ce6000090e60000................
⋯5 more rows
0x124456ef000068ef000080ef00008eef0000V...h...........
0x12549cef0000a8ef0000b4ef0000c2ef0000................
0x1264d2ef0000e2ef0000f2ef000002f00000................
⋯3 more rows
0x12a402ef0000caee0000dcee000090ee0000................
0x12b4b8ee0000a6ee00007aee000066ee0000........z...f...
⋯5 more rows
0x17570068007400740070003a002f002f0032.h.t.t.p.:././.2
0x176700300037002e00340036002e00310037.0.7...4.6...1.7
0x17770036002e003200340037002f006d0073.6...2.4.7./.m.s
0x1787006e0064006100740061002d00620076.n.d.a.t.a.-.b.v
0x17970074002f006d00640073006500720076.t./.m.d.s.e.r.v
0x17a700650072002e0064006c006c00000000.e.r...d.l.l....
0x17b700420056005400000068007400740070.B.V.T...h.t.t.p
0x17c7003a002f002f003200300037002e0034.:././.2.0.7...4
0x17d70036002e003100370036002e00320034.6...1.7.6...2.4
0x17e70037002f006700750069006400670065.7./.g.u.i.d.g.e
0x17f7006e002f006700750069006400670065.n./.g.u.i.d.g.e
0x1807006e002e0064006c006c000000680074.n...d.l.l...h.t
0x181700740070003a002f002f003200300037.t.p.:././.2.0.7
0x1827002e00340036002e003100370036002e...4.6...1.7.6..
0x1837003200340037002f006d0073006e0064.2.4.7./.m.s.n.d
0x1847006100740061002f006d006400730065.a.t.a./.m.d.s.e
0x18570072007600650072002e0064006c006c.r.v.e.r...d.l.l
0x1867000000000068007400740070003a002f.....h.t.t.p.:./
0x1877002f00730071006d002e006d0073006e./.s.q.m...m.s.n
0x1887002e0063006f006d002f006700750069...c.o.m./.g.u.i
0x1897006400670065006e002f006700750069.d.g.e.n./.g.u.i
0x18a7006400670065006e002e0064006c006c.d.g.e.n...d.l.l
0x18b7000000000068007400740070003a002f.....h.t.t.p.:./
0x18c7002f00730071006d002e006d0073006e./.s.q.m...m.s.n
0x18d7002e0063006f006d002f006d0073006e...c.o.m./.m.s.n
0x18e70064006100740061002f006d00640073.d.a.t.a./.m.d.s
⋯13 more rows
0x112160000703a01003e000000000000000000..p:..>.........
0x112260000402201000c060000000000000000..@"............
0x11236000000000000000000000c0634000000............4...
0x11246560053005f0056004500520053004900V.S._.V.E.R.S.I.
0x112564f004e005f0049004e0046004f000000O.N._.I.N.F.O...
⋯6 more rows
0x112c6300034003000390030003400420030000.4.0.9.0.4.B.0.
0x112d600004c001600010043006f006d007000..L.....C.o.m.p.
0x112e661006e0079004e0061006d0065000000a.n.y.N.a.m.e...
0x112f600004d006900630072006f0073006f00..M.i.c.r.o.s.o.
0x1130666007400200043006f00720070006f00f.t. .C.o.r.p.o.
0x1131672006100740069006f006e0000003600r.a.t.i.o.n...6.
0x1132607000100460069006c00650044006500....F.i.l.e.D.e.
0x1133673006300720069007000740069006f00s.c.r.i.p.t.i.o.
0x113466e000000000075007000640061007400n.....u.p.d.a.t.
0x113566500000000003e000f00010046006900e.....>.....F.i.
0x113666c006500560065007200730069006f00l.e.V.e.r.s.i.o.
0x113766e000000000036002e00310030002e00n.....6...1.0...
0x1138630003000310036002e003100360032000.0.1.6...1.6.2.
0x113963400000000002e000700010049006e004...........I.n.
0x113a67400650072006e0061006c004e006100t.e.r.n.a.l.N.a.
0x113b66d006500000075007000640061007400m.e...u.p.d.a.t.
⋯11 more rows
0x114766500780065000000000076002b000100e.x.e.....v.+...
0x11486500072006f0064007500630074004e00P.r.o.d.u.c.t.N.
0x1149661006d006500000000004d0069006300a.m.e.....M.i.c.
⋯4 more rows
0x114e62000530079007300740065006d000000 .S.y.s.t.e.m...
0x114f6000042000f000100500072006f006400..B.....P.r.o.d.
0x1150675006300740056006500720073006900u.c.t.V.e.r.s.i.
⋯7 more rows
0x12ff000000000000000000000000000000000................
0x13000558bec81ec8c00000064a13000000089U........d.0....
0x1301045d8c745e800e20000c745c4433a5c31E..E......E.C:\1
0x13020c745c866323436c745cc3934642ec745.E.f246.E.94d..E
⋯15 more rows