Suspicious 80% Download

Trojan-Dropper.Win32.Delf.atm

Trojan dropper with embedded PE

Compact high-entropy RWX UPX1 sectionHigh-entropy UPX1 packed payload section
SHA-25662294139d9188b2f514bee8ffc070c8ae8f315c23ccc65f8034a21d9d086b819
MaleculeH(Po₂)Md(Bi)

Evidence

Embedded PE binary at file offset 0x4a388 (~235128 bytes) 0x4a348–0x4a418
⋯3 more rows
0x4a378000000004e45545343415045322e3090....NETSCAPE2.0.
0x4a3884d5a50000200000004000f00ffff0000MZP.............
0x4a398b80000000000000040001a0000000000........@.......
0x4a3a800000000000000000000000000000000................
⋯7 more rows
References the Windows debugger output API 0x76e44–0x76f14
⋯3 more rows
0x76e745065656b4e616d656450697065000000PeekNamedPipe...
0x76e844f75747075744465627567537472696eOutputDebugStrin
0x76e946741000000004f70656e50726f636573gA....OpenProces
0x76ea4730000004d756c446976000000004d6fs...MulDiv....Mo
⋯7 more rows
Execute shell command (ShellExecuteA) 0x7a6fc–0x7a7bc
⋯3 more rows
0x7a72c8400000016307e308b301b31a731d831.....0~0.0.1.1.1
0x7a73ce53107323e326c327932a132a632cd32.1.2>2l2y2.2.2.2
0x7a74cda3218335f338833b033d033e133ed33.2.3_3.3.3.3.3.3
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.