instapp.a.1.02.exe
Legitimate PDF printer driver
Dominant low-entropy writable .data padding geometryMassive low-entropy writable .data section
SHA-256524b0b9f10daa60f347cf8f906fd79fa43855df1d5fef2b9a58a90d543c5fdf4
Evidence
⋯3 more rows
0x3f000000000000000000000000000000000................
0x400cccccccccccccccccccccccccccccccc................
0x410e9cff4072a2f26fef3fd0cd182b9fefe....*/&.........
0x42084919d889592d09c8d96fefebdb4fefe................
0x430c6a7d3ceccfefefe7073617071300000........psapq0..
0x4400000f60900cccccccccccccccccccccc................
0x450e99bb20200cccccccccccccccccccccc................
0x460e91b3e0300cccccccccccccccccccccc..>.............
0x470e947010b00cccccccccccccccccccccc.G..............
0x480e9ab810500cccccccccccccccccccccc................
0x490e9f3220b00cccccccccccccccccccccc..".............
0x4a0e90b7c0700cccccccccccccccccccccc..|.............
0x4b0e9f3b60b00cccccccccccccccccccccc................
0x4c0e95b650900cccccccccccccccccccccc.[e.............
0x4d0e9573a0a00cccccccccccccccccccccc.W:.............
0x4e0e96fc60700cccccccccccccccccccccc.o..............
0x4f0e92b760d00cccccccccccccccccccccc.+v.............
0x500e9eba00600cccccccccccccccccccccc................
0x510e9ef8f0c00cccccccccccccccccccccc................
0x520e987680900cccccccccccccccccccccc..h.............
0x530e9dfb90d00cccccccccccccccccccccc................
0x540e97bf20100cccccccccccccccccccccc.{..............
0x550e96b080a00cccccccccccccccccccccc.k..............
0x560e9554889e54883ec484883c0084181f2.UH..H..HH...A..
0x570696e65494533db4533db450bd04883c0ineIE3.E3.E..H..
0x58008e8170000004885c07405e9b0020000......H..t......
0x590eb02eb0233c0c84883c4485dc34d33ff....3..H..H].M3.
0x5a0498bc7499749970f01f948c1e220480bI..I.I....H.. H.
0x5b0c24c8bf049c7c4000000004983c40149.L..I......I...I
0x5c083ec0149bd00286bee0000000053d9fc...I..(k.....S..
0x5d05b0f01f948c1e220480bc2492bc6493b[...H.. H..I+.I;
0x5e0c572ea55488d6424f849c7c310000000.r.UH.d$.I......
0x5f049c7c1c3a0e8044833c94d8d49ff4d85I......H3.M.I.M.
0x600c975f74c8bd04d03d149ffcb75e248c7.u.L..M..I..u.H.
0x610c002000000488d6424085dc3cccccccc.....H.d$.].....
0x620e92fe40b00cccccccccccccccccccccc./..............
0x630e9b31d0a00cccccccccccccccccccccc................
0x640e9673c0800cccccccccccccccccccccc.g<.............
0x650e9377d0d00cccccccccccccccccccccc.7}.............
0x660e99b680200cccccccccccccccccccccc..h.............
0x670e937860c00cccccccccccccccccccccc.7..............
0x53df00488bc8448bc3ff1524c4010033d241.H..D....$...3.A
0x53efb800100000488d1db56a0200488bcbe8.....H...j..H...
0x53fffd3700008d55f6488bcfff15d1c30100.7...U.H........
0x540f41b800080000488bd3488bc8ff15efc3A.....H..H......
0x541f0100488bcbe8173f0000488d0de03f02..H....?..H...?.
0x543f3f0200e8dd2e0000488d0d02410200e8?.......H...A...
0x544fd12e000033c04883c430415c5f5e5d5b....3.H..0A\_^][
0x545fc34883ec28894c2430488d15011f0200.H..(.L$0H......
0x546f488d4c2430e8d73e0000cccccc405356H.L$0..>.....@SV
0x547f4881ec88020000488b05034402004833H......H...D..H3
0x548fc4488984247002000083ea01488bf10f.H..$p......H...
0x549f84 .
0x914c0000fd660f57c0e91b0100000fb74d00...f.W........M.
0x915c4c8d44244866ba0800e8d65a000085c0L.D$Hf.....Z....
0x916c741c66900fb74b024883c3024c8d4424t.f...K.H...L.D$
0x917c4866ba0800e8ba5a000085c075e633c0Hf.....Z....u.3.
0x918c48c7c1ffffffff488bfb66f2af488d44H......H..f..H.D
0x919c24484533c948f7d14889442428488bd3$HE3.H..H.D$(H..
0x91ac4c8d41ff488d4c2430c7442420000000L.A.H.L$0.D$ ...
0x91bc00e87e5900004885f6740b4863480448..~Y..H..t.HcH.H
0x91cc8d144b4889168b08660f7f742470f7c1..KH....f..t$p..
0x91dc40020000740e4885f6660f57f6746b48@...t.H..f.W.tkH
0x91ec892eeb66f6c181743866833b2d751df2...f...t8f.;-u..
0x91fc0f1035dd980100f20f5c35c5100200e8..5......\5.....
0x920cb0280000c70022000000eb3ef20f1035.(...."....>...5
0x921cb0100200 ....
⋯5 more rows
0x281f000000000000000000000000000000000................
0x28200a8f64100000000000100000000000000..A.............
0x2821001000080ffffffff808e420000000000..........B.....
0x2822080f64100000000000100000000000000..A.............
0x28230000000000000000001000080ffffffff................
0x28240808e42000000000060f6410000000000..B.....`.A.....
0x2825004000000000000000000000000000000................
0x2826001000080ffffffff808e420000000000..........B.....
0x2827038f641000000000001000000000000008.A.............
0x28280000000000000000001000080ffffffff................
0x28290808e42000000000020f6410000000000..B..... .A.....
0x282a004000000000000000000000000000000................
0x282b001000080ffffffff808e420000000000..........B.....
0x282c0f8f54100000000000100000000000000..A.............
0x282d0000000000000000001000080ffffffff................
0x282e0808e420000000000c8f5410000000000..B.......A.....
0x282f004000000000000000000000000000000................
0x2830001000080ffffffff808e420000000000..........B.....
0x2831090f54100000000000100000000000000..A.............
0x2832000000000000000000000000000000000................
0x2833000000000000000000000000000000000................
0x2834000000000000000000000000000000000................
0x2835002000080ffffffff808e420000000000..........B.....
0x2836080f64100000000000100000000000000..A.............
0x28370000000000000000002000080ffffffff................
0x28380808e42000000000060f6410000000000..B.....`.A.....
0x2839004000000000000000000000000000000................
0x283a002000080ffffffff808e420000000000..........B.....
0x283b038f641000000000001000000000000008.A.............
0x283c0000000000000000002000080ffffffff................
0x283d0808e42000000000020f6410000000000..B..... .A.....
0x283e004000000000000000000000000000000................
0x283f002000080ffffffff808e420000000000..........B.....
0x28400f8f54100000000000100000000000000..A.............
0x28410000000000000000002000080ffffffff................
0x28420808e420000000000c8f5410000000000..B.......A.....
0x2843004000000000000000000000000000000................
0x2844002000080ffffffff808e420000000000..........B.....
0x2845090f54100000000000100000000000000..A.............
0x2846000000000000000000000000000000000................
0x2847000000000000000000000000000000000................
0x2848000000000000000000000000000000000................
0x2849001000000000800004807420000000000........H.B.....
0x9045f00000000000000000000000000000000................
0x9046f00000000000000003c3c4552524f523e........<<ERROR>
0x9047f3e0000006572720065785f6461746100>...err.ex_data.
0x9048f7835303900000000783530395f696e66x509....x509_inf
0x9049f6f00000064736100783530395f706b65o...dsa.x509_pke
0x904af7900000072736100783530395f63726cy...rsa.x509_crl
0x904bf0000000073736c00783530395f726571....ssl.x509_req
0x904cf0000000072616e643200000042494f00....rand2...BIO.
0x904df6576705f706b65790000000064680000evp_pkey....dh..
0x904ef78353039 x509