Hostile ^92% Download

SecuriteInfo.com.Variant.Draftor.18784.68695845

Masquerades as Microsoft DLL, unsigned

Binary imports ADVAPI32.dllMicrosoft company version identity

SHA-2565001c94c26e86d35be14a44c7539c11cd7c6ad6e90d6dbdbe0fb20d75a5d98f8

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₃(As₄Er₃Pr)H₇(CrDbFMgOs₃Po₃Ti)Md₄(Bi₇PaSi)

Evidence

x86 indirect call through a global pointer 0x3c0–0x650

⋯3 more rows
0x3f000000000000000000000000000000000................
0x4008d442410506a00ff742414ff74241468.D$.Pj..t$..t$.h
0x41000020000ff742418e84448000083c418.....t$..DH.....
0x420c38d442410506a00ff742414ff742414..D$.Pj..t$..t$.
⋯7 more rows
0x4a074fdffff5350e8355f0000a154390210t...SP.5_...T9..
0x4b083c40c8b3580b00110bf0401000085c0....5...........
0x4c0740b578d8d74fdffff5150ffd6668b85t.W..t...QP..f..
⋯4 more rows
0x5101977088d41200fb7d0eb0a6a5c6683f9.w..A .....j\f..
0x5202f580f44d083c7020fb7c233c669f093/X.D.......3.i..
0x5300100010fb7078bc86685c075ca8bc635........f..u...5
0x540a5a5a5a550568d857cffffff6a4050e8....PV..|...j@P.
⋯17 more rows

Percent-encoded content decoded 0x1a38c–0x1a45c

⋯3 more rows
0x1a3bc6f0063002e006c006f00670000000000o.c...l.o.g.....
0x1a3cc5b253034642d253032642d2530326420[%04d-%02d-%02d 
0x1a3dc253032643a253032643a253032645d20%02d:%02d:%02d] 
0x1a3ec7069643d256c7520256c730d0a000000pid=%lu %ls.....
⋯7 more rows

Binary imports ADVAPI32.dll 0x1a5e4–0x1a6a4

⋯3 more rows
0x1a614fbfbcadedcbeb2b48391687d56410000..........h}VA..
0x1a62461006400760061007000690033003200a.d.v.a.p.i.3.2.
0x1a6342e0064006c006c00000000004f70656e..d.l.l.....Open
⋯7 more rows

Copy files (Windows API wide) 0x1afcc–0x1b1dc

⋯3 more rows
0x1affc746f72270000000060766563746f7220tor'....`vector 
0x1b00c766261736520636f6e7374727563746fvbase constructo
0x1b01c72206974657261746f72270060766972r iterator'.`vir
0x1b02c7475616c20646973706c6163656d656etual displacemen
0x1b03c74206d61702700006065682076656374t map'..`eh vect
0x1b04c6f7220636f6e7374727563746f722069or constructor i
0x1b05c74657261746f72270000000060656820terator'....`eh 
0x1b06c766563746f722064657374727563746fvector destructo
0x1b07c72206974657261746f72270060656820r iterator'.`eh 
0x1b08c766563746f7220766261736520636f6evector vbase con
0x1b09c7374727563746f72206974657261746fstructor iterato
0x1b0ac7227000060636f707920636f6e737472r'..`copy constr
0x1b0bc7563746f7220636c6f73757265270000uctor closure'..
0x1b0cc607564742072657475726e696e672700`udt returning'.
0x1b0dc604548006052545449000000606c6f63`EH.`RTTI...`loc
0x1b0ec616c2076667461626c652700606c6f63al vftable'.`loc
0x1b0fc616c2076667461626c6520636f6e7374al vftable const
0x1b10c727563746f7220636c6f737572652700ructor closure'.
0x1b11c206e65775b5d00002064656c6574655b new[].. delete[
0x1b12c5d000000606f6d6e692063616c6c7369]...`omni callsi
0x1b13c6727000060706c6163656d656e742064g'..`placement d
0x1b14c656c65746520636c6f73757265270000elete closure'..
0x1b15c60706c6163656d656e742064656c6574`placement delet
⋯8 more rows

Dense api-ms-win-core string cluster 0x1b38c–0x1b54c

⋯3 more rows
0x1b3bc27000000cccb011008cc011044cc0110'...........D...
0x1b3cc6100700069002d006d0073002d007700a.p.i.-.m.s.-.w.
0x1b3dc69006e002d0063006f00720065002d00i.n.-.c.o.r.e.-.
0x1b3ec6600690062006500720073002d006c00f.i.b.e.r.s.-.l.
0x1b3fc31002d0031002d0031000000610070001.-.1.-.1...a.p.
0x1b40c69002d006d0073002d00770069006e00i.-.m.s.-.w.i.n.
0x1b41c2d0063006f00720065002d0073007900-.c.o.r.e.-.s.y.
0x1b42c6e00630068002d006c0031002d003200n.c.h.-.l.1.-.2.
0x1b43c2d003000000000006b00650072006e00-.0.....k.e.r.n.
0x1b44c65006c00330032000000000061007000e.l.3.2.....a.p.
0x1b45c69002d006d0073002d00000000000000i.-.m.s.-.......
0x1b46c02000000466c73416c6c6f6300000000....FlsAlloc....
⋯14 more rows