Benign Download

Trojan-GameThief.Win32.Magania.bkt

Detects an XORed URL in an executableEmbedded PE binary at file offset 0x46fc (~140036 bytes)
SHA-25659707938ee7908d30abe45c276ea3dac9d8664fe517e2a78519a8500a98fc09b
MaleculeMdTh

Evidence

Embedded PE binary at file offset 0x46fc (~140036 bytes) 0x46bc–0x478c
⋯3 more rows
0x46ec263d4f38c28237b8f3244203179b3a83&=O8..7..$B...:.
0x46fc4d5a50000200000004000f00ffff0000MZP.............
0x470cb80000000000000040001a0000000000........@.......
0x471c00000000000000000000000000000000................
⋯7 more rows
Detects an XORed URL in an executable 0x9ef8–0x9fb8
⋯3 more rows
0x9f28eb5f5e5b8be55dc3ffffffff07000000._^[..].........
0x9f38687474703a2f2f00ffffffff01000000http://.........
0x9f482f000000558bec51b9890000006a006a/...U..Q.....j.j
⋯7 more rows
Encoded content decoded: xor 0x18f78–0x19268
⋯3 more rows
0x18fa86959575300000000ffffffff1e000000iYWS............
0x18fb8e8f4f4f0baafaff4f7aee7e1f3e8e3e1................
0x18fc8f2e4aee7e1ede1eee9e1aee3efed0000................
0x18fd8ffffffff1f000000e8f4f4f0baafaff4................
0x18fe8f7aee7e1f3e8e3e1f2e4aee7e1ede1ee................
0x18ff8e9e1aee3efedaf00ffffffff28000000............(...
0x19008e8f4f4f0baafaff4f7aee7e1f3e8e3e1................
0x19018f2e4aee7e1ede1eee9e1aee3efedafe9................
0x19028eee4e5f8aee1f3f000000000ffffffff................
0x190382a000000e8f4f4f0f3baafaff4f7aee7*...............
0x19048e1f3e8aee7e1ede1eee9e1aee3efedaf................
0x19058c7c1d3c8ccefe7e9eeaee1f3f0f80000................
0x19068ffffffff1b000000e8f4f4f0f3baafaf................
0x19078f4f7aee7e1f3e8aee7e1ede1eee9e1ae................
0x19088e3efed00ffffffff1c000000e8f4f4f0................
0x19098f3baafaff4f7aee7e1f3e8aee7e1ede1................
0x190a8eee9e1aee3efedaf00000000ffffffff................
0x190b82a000000e8f4f4f0f3baafaff4f7aee7*...............
0x190c8efefe4ecefe3ebaee7e1ede1eee9e1ae................
0x190d8e3efedafe9eee4e5f8aee1f3f0f80000................
0x190e8ffffffff2a000000e8f4f4f0f3baafaf....*...........
0x190f8f4f7aee7efefe4ecefe3ebaee7e1ede1................
0x19108eee9e1aee3efedafc9eee4e5f8aee1f3................
0x19118f0f80000ffffffff2b000000e8f4f4f0........+.......
0x19128baafaff4f7aee7e1ede1eee9e1aee3ef................
0x19138edafc7c8cfcdc5afc8efede5dfc3e5ee................
0x19148f4e5f2aec1d3d000ffffffff16000000................
0x19158e8f4f4f0baafaff4f7aee7e1ede1eee9................
0x19168e1aee3efedaf0000ffffffff15000000................
0x19178e8f4f4f0baafaff4f7aee7e1ede1eee9................
0x19188e1aee3efed000000ffffffff2e000000................
0x19198e8f4f4f0baafaff4f7aee7e1ede1eee9................
0x191a8e1aee3efedafe4e5e6e1f5ecf4aee1f3................
0x191b8f0bff5f3e5f2dfecefe3e1f4e5bd0000................
0x191c8ffffffff26000000e8f4f4f0f3baafaf....&...........
0x191d8f4f7aee7e1f3e8aee7e1ede1eee9e1ae................
0x191e8e3efedafc2ece1eeebaee1f3f0f80000................
0x191f8ffffffff28000000e8f4f4f0baafaff4....(...........
0x19208f7aee7e1f3e8e3e1f2e4aee7e1ede1ee................
0x19218e9e1aee3efedaff3f0e1e3e5aee8f4ed................
0x1922800000000ffffffff1f000000e8f4f4f0................
0x19238f3baafaff4f7aee7efefe4ecefe3ebae................
⋯3 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.