Suspicious 80% Download

Net-Worm.Win32.Incef.c

Worm with P2P and XOR payload

Kazaa LocalContent registry keyP2P file sharing forcefully enabled
SHA-2565d9b84844adb37a10f36b9785f8ec36f61a805aeffd19e25349100704a5b7147
MaleculeH(F)Md

Evidence

Kazaa LocalContent registry key 0x20cdd–0x20e0d
⋯5 more rows
0x20d2dffffff1b000000536f6674776172655c.......Software\
0x20d3d4b617a61615c4c6f63616c436f6e7465Kazaa\LocalConte
0x20d4d6e7400ffffffff0e0000004469736162nt.........Disab
0x20d5d6c6553686172696e670000ffffffff07leSharing.......
0x20d6d0000003031323334353a00ffffffff06...012345:......
⋯10 more rows
Encoded content decoded: xor 0x20e3c–0x20fec
⋯3 more rows
0x20e6c6a776029627f6200ffffffff23000000jw`)b.b.....#...
0x20e7c746f667562635b776875695877667474tofubc[whuiXwftt
0x20e8c706875635864686b6b6264736e686929phucXdhkkbdsnhi)
0x20e9c627f6200ffffffff13000000746f6675b.b.........tofu
0x20eac62635b666e6a586f66646c29627f6200bc[fnjXofdl)b.b.
⋯7 more rows
0x20f2c716e636268296a776029627f62000000qncbh)jw`)b.b...
0x20f3cffffffff23000000746f667562635b77....#...tofubc[w
0x20f4c626368586575667d6e6b6e6669586c6ebchXeuf}nknfiXln
0x20f5c6374296a77626029627f6200ffffffffct)jwb`)b.b.....
0x20f6c19000000746f667562635b43626b776f....tofubc[Cbkwo
0x20f7c6e583058447566646c29627f62000000nX0XDufdl)b.b...
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.