Benign Download

Backdoor.Win32.Poison.hxm

Entry point in a writable RWX sectionPE lacks signature record
SHA-2565062a4d909a9288ccdd24de66f58c5a5acaf882246e6ace442413458e5f24c12
MaleculeO(As)Md₃(Bi₂Si)

Evidence

Entry point in a writable RWX section 0x0–0xe0
0x04d5a00000100000002000000ffff0000MZ..............
0x1040000000000000004000000000000000@.......@.......
0x20b44ccd21000000000000000000000000.L.!............
0x3000000000000000000000000080000000................
⋯11 more rows
Writable and exe section (W^X violation) 0x1a2–0x2d2
⋯5 more rows
0x1f200000000000000000000000000006865..............he
0x2026c6c6f5f61765f6775790d0a75736572llo_av_guy..user
0x2123332007368656c6c333200616476617032.shell32.advap
0x2226933320089fd12a49341744516d6d6c0i32......AtE....
⋯11 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.