Suspicious 80% pe-machine-learning-dataset Download

529291

Tiny, unsigned, obfuscated .NET

Tiny .NET assembly (< 8KB)Tiny PE by file size
SHA-25652470a00347d12a656c8f1fdf4bd3d769fc771a14f021c9c5f9e4dbd2b2828bb

Evidence

Code entropy is 7.5 or lower 0x1d0–0x450
0x1d00c000000006000000002000000100000.....`..........
0x1e000000000000000000000000040000042[email protected]
0x1f000000000000000000000000000000000................
0x20040280000000000004800000002000500@(......H.......
0x210b0210000580600000300000004000006.!..X...........
0x22000000000000000000000000000000000................
0x23000000000000000000000000000000000................
0x24000000000000000000000000000000000................
0x2501e02280f00000a2a1b300600bc000000..(....*.0......
0x2600100001102280100000a03730200000a.....(.....s....
0x2700a18171c730300000a0b07066f040000....s.......o...
0x2800add0800000026140cdd900000001a8d......&.........
0x290090000010d07091a166f0500000a2609.........o....&.
0x2a016280600000a130411041b588d090000.(.........X....
0x2b001130516130638300000001106071105......80........
0x2c011061b58110411065920001000003c0a...X....Y ....<.
0x2d000000011041106593805000000200010.......Y8.... ..
0x2e00000166f0700000a581306110611043f...o....X......?
0x2f0c7ffffff076f0800000a280900000a28.....o....(....(
0x3000a00000a13071107161105171a280b00.............(..
0x310000a11051620bf0000009c11052a082a..... .......*.*
0x32001100000000016000c22000808000001........."......
0x330133006004c0000000200001102394500.0..L........9E.
0x340000016028e6920001000001f40280500.....i .....@(..
0x35000060a0216066e280c00000a028e6928......n(......i(
0x3600d00000a7e0e00000a0b160c7e0e0000....~.......~...
0x3700a0d1616060916120228060000060b07.........(......
0x380152807000006262a1330020019000000.(....&*.0......
0x39003000011140a7201000070205c110000......r...p \...
0x3a028020000060a0628030000062a000000(......(....*...
0x3b042534a4201000100000000000c000000BSJB............
0x3c076342e302e3330333139000000000500v4.0.30319......
0x3d06c0000004c020000237e0000b8020000l...L...#~......
0x3e09802000023537472696e677300000000....#Strings....
0x3f050050000200000002355530070050000P... ...#US.p...
0x40010000000234755494400000080050000....#GUID.......
0x410d800000023426c6f6200000000000000....#Blob.......
0x42002000010471502140900000000fa0133....G..........3
0x43000160000010000000f00000002000000................
0x440070000000f0000001000000001000000................
0x45003000000010000000300000001000000................
mscorlib reference 0x67a–0x96a
0x67a0068486c74516d766f76006353517655.hHltQmvov.cSQvU
0x68a41584a6d510041507176424859634b42AXJmQ.APqvBHYcKB
0x69a4558566a004950456e64506f696e7400EXVj.IPEndPoint.
0x6aa53797374656d2e4e6574004950416464System.Net.IPAdd
0x6ba72657373005061727365002e63746f72ress.Parse..ctor
0x6ca00536f636b65740053797374656d2e4e.Socket.System.N
0x6da65742e536f636b657473004164647265et.Sockets.Addre
0x6ea737346616d696c7900536f636b657454ssFamily.SocketT
0x6fa7970650050726f746f636f6c54797065ype.ProtocolType
0x70a00436f6e6e65637400456e64506f696e.Connect.EndPoin
0x71a74004f626a6563740053797374656d00t.Object.System.
0x72a42797465005265636569766500536f63Byte.Receive.Soc
0x73a6b6574466c61677300426974436f6e76ketFlags.BitConv
0x74a657274657200546f496e743332006765erter.ToInt32.ge
0x75a745f48616e646c6500496e7450747200t_Handle.IntPtr.
0x76a6f705f4578706c696369740047657442op_Explicit.GetB
0x77a7974657300417272617900436f707900ytes.Array.Copy.
0x78a476a4873516f636e4e4742476e764400GjHsQocnNGBGnvD.
0x79a4d61727368616c0053797374656d2e52Marshal.System.R
0x7aa756e74696d652e496e7465726f705365untime.InteropSe
0x7ba727669636573005a65726f0056697274rvices.Zero.Virt
0x7ca75616c416c6c6f63006b65726e656c33ualAlloc.kernel3
0x7da32005a6145444c6976706842706700662.ZaEDLivphBpg.f
0x7ea53486a6b6d00425678674a7245626e00SHjkm.BVxgJrEbn.
0x7fa5a64717a5675564f0043726561746554ZdqzVuVO.CreateT
0x80a68726561640078786a43425600714146hread.xxjCBV.qAF
0x81a6579494c42617a006b6e427476734476eyILBaz.knBtvsDv
0x82a5473515600505264646f6a4f49786176TsQV.PRddojOIxav
0x83a71450056735558765a54597673546a45qE.VsUXvZTYvsTjE
0x84a004365637a6b41527463684b00576169.CeczkARtchK.Wai
0x85a74466f7253696e676c654f626a656374tForSingleObject
0x86a00665a52436143796f797a4100595550.fZRCaCyoyzA.YUP
0x87a6f43494c4b73444665716f7000416955oCILKsDFeqop.AiU
0x88a427a556a516e5500686f645a78544b7aBzUjQnU.hodZxTKz
0x89a516b004d61696e007061796c6f616400Qk.Main.payload.
0x8aa52756e74696d65436f6d706174696269RuntimeCompatibi
0x8ba6c697479417474726962757465005379lityAttribute.Sy
0x8ca7374656d2e52756e74696d652e436f6dstem.Runtime.Com
0x8da70696c65725365727669636573006d73pilerServices.ms
0x8ea636f726c6962007061796c6f61642e65corlib.payload.e
0x8fa786500000000001b3100390032002e00xe......1.9.2...
0x90a3100360038002e0031002e00310039001.6.8...1...1.9.
0x91a3500000000003baf823b9589d94aba485.....;..;...J.H
0x92ac415cbfcea610005000112090e062002.....a........ .
0x93a01120908092003011111111511190520..... .........
0x94a0101121d082003081d05081129060002..... ......)...
0x95a081d0508092004081d05080811290320..... .......).
0x96a001804000108 ......
PE version metadata includes CompanyName 0xd16–0xf46
⋯3 more rows
0xd4674007300000020000000240002000100t.s... ...$.....
0xd5643006f006d00700061006e0079004e00C.o.m.p.a.n.y.N.
0xd6661006d00650000000000200000002c00a.m.e..... ...,.
0xd7602000100460069006c00650044006500....F.i.l.e.D.e.
0xd8673006300720069007000740069006f00s.c.r.i.p.t.i.o.
0xd966e000000000020000000300008000100n..... ...0.....
0xda6460069006c0065005600650072007300F.i.l.e.V.e.r.s.
0xdb669006f006e000000000030002e003000i.o.n.....0...0.
0xdc62e0030002e0030000000300008000100..0...0...0.....
0xdd649006e007400650072006e0061006c00I.n.t.e.r.n.a.l.
0xde64e0061006d0065000000700061007900N.a.m.e...p.a.y.
0xdf66c006f00610064000000280002000100l.o.a.d...(.....
0xe064c006500670061006c0043006f007000L.e.g.a.l.C.o.p.
0xe1679007200690067006800740000002000y.r.i.g.h.t... .
0xe2600002c00020001004c00650067006100..,.....L.e.g.a.
⋯5 more rows
0xe86610064002e0065007800650000002400a.d...e.x.e...$.
0xe9602000100500072006f00640075006300....P.r.o.d.u.c.
0xea674004e0061006d006500000000002000t.N.a.m.e..... .
0xeb60000280002000100500072006f006400..(.....P.r.o.d.
0xec675006300740056006500720073006900u.c.t.V.e.r.s.i.
0xed66f006e00000020000000000000000000o.n... .........
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.