Benign Download

Trojan-PSW.Win32.QQPass.ctv

Detects an XORed URL in an executable
SHA-2564adf208d0f48c8ff1a6f87e4f9e657a82aea72469efff95558bb9c17e3126007
MaleculeTh

Evidence

Detects an XORed URL in an executable 0xa1c7–0xa287
⋯3 more rows
0xa1f70000000000000000003b3f3f3d39382a.........;??=98*
0xa2076478787c3623236a796f677563796679dxx|6##jyogucyfy
0xa2176222676765226f62235d5d226d7f7c2ab"gge"ob#]]"m.|*
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.