Suspicious 80% Download

Worm.Win32.Runfer.is

Known worm, signed, tampered

File changed after it was signedAuthenticode chain CN: www.5bao.net
SHA-2564dd425984621c6d6512f851fe53c637b8d628cc9be13acf8fd96782ea229e67a
MaleculeMd₂(BiSi₂)

Evidence

File changed after it was signed 0x0–0x50
0x04d5a40000100000002000000ffff0000MZ@.............
0x100002000000000000400000e900000000........@.......
0x20b409ba0b01cd21b44ccd210000000000......!.L.!.....
⋯3 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.