Benign Download

Net-Worm.Win32.Kolab.agn

High-entropy UPX1 packed payload sectionIsDebuggerPresent API name in PE strings
SHA-2564ed75db44dc552fa4df4f1aec12b3a2f7f04957a2081ce11528cbf5880d6db5d
MaleculeH(Po₂)Md(Bi)

Evidence

High-entropy UPX1 packed payload section 0x1c0–0x290
⋯3 more rows
0x1f000000000000000000000000000000000................
0x200db34ffff04104000010843617264696e[email protected]
0x210616c0500ff901c176cb7dfbe0a065374al......l.....St
0x220721667ff259c700d8bc0079832c82083r.g.%.p.....2. .
⋯7 more rows
IsDebuggerPresent API name in PE strings 0x558c9–0x55999
⋯3 more rows
0x558f96f6465202564290025583a4441460000ode %d).%X:DAF..
0x559094973446562756767657250726573656eIsDebuggerPresen
0x55919740000004b65726e656c333200000000t...Kernel32....
0x55929284c6f636174696f6e205845422c2065(Location XEB, e
⋯7 more rows
References the Windows debugger output API 0x55b91–0x55c71
⋯3 more rows
0x55bc16d000000777269746520746f00000000m...write to....
0x55bd14f75747075744465627567537472696eOutputDebugStrin
0x55be1675700004f7574707574446562756753gW..OutputDebugS
0x55bf17472696e674100005f52530025750000tringA.._RS.%u..
0x55c0153657450726f6365737353687574646fSetProcessShutdo
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.