Benign Download

Backdoor.Win32.VB.hon

Detects an XORed URL in an executableEncoded content decoded: xor
SHA-25662cada136c266ef3d2144bf35cd1c7515433df266d47aecf0414452b3dbdf4d0
MaleculeMdTh

Evidence

Encoded content decoded: xor 0x4fe3–0x52d3
⋯3 more rows
0x50135c9e1e3d7e000206020202fdfd0202ba\..=~...........
0x502302020202020202420202020202020202.......B........
0x503302020202020202020202020202020202................
0x50430202020202020202020202ba0202020c................
0x50531db80c02b60bcf23ba034ecf23566a6b.......#..N.#Vjk
⋯3 more rows
0x50931005d9f1716b8af1716b8af1716b8a18....qk..qk..qk..
0x50a36e668af0716b8a506b616af1716b8a02nf..qk.Pkaj.qk..
0x50b302020202020202020202020202020202................
0x50c302020202020202524702024e0301029e.......RG..N....
0x50d3bde9470202020202020202e2020d0309..G.............
0x50e30304020292020202720202020202020e........r.......
0x50f31302020212020202a202020202420202.............B..
0x510312020202120202060202020302020206................
0x511302020202020202022203020212020202........".......
0x512302020200020202020212020212020202................
0x513302120202120202020202021202020202................
0x514302020202020202769602022a02020202.......v...*....
0x5153b20202426e0202020202020202020202...Bn...........
0x516302020202020202020202020202020202................
0x517302020202020202020202020202020202................
0x518302020202020202020202020202020202................
0x519302020202020202020202020202020202................
⋯7 more rows
0x521370717061020202426e020202b2020202pqpa...Bn.......
0x522372020202a20202020202020202020202r...............
0x523302020242020242020202020202020202...B..B.........
0x524302020202020202020202020202020202................
0x525302020202020202020202020202020202................
0x526302020202020202020202020202020202................
⋯7 more rows
Detects an XORed URL in an executable 0x32ef6–0x32fb6
⋯3 more rows
0x32f2632243226040a2904030707053203841a2$2&..).....2...
0x32f366a767672382d2d6d6171722c7467706bjvvr8--maqr,tgpk
0x32f46716b656c2c616d6f32100401571f1103qkel,amo2...W...
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.