Benign Download

Windows ⁇⁇⁇⁇⁇!.7z

LineDDA graphics callbackEnumFonts callback shellcode execution API
SHA-2566792453dfe6b1eef4179acdc7102e9739e7b02763a39ed1cad9430aeeaa5e237
MaleculeO(Er)H(Os)

Evidence

.dll extension reference 0x44ff8–0x45058
0x44ff8744572726f7200006b65726e656c3332tError..kernel32
0x450082e646c6c00000e0252746c456e756d65.dll....RtlEnume
0x450187261746547656e657269635461626c65rateGenericTable
⋯4 more rows
LineDDA graphics callback 0x45ff8–0x46078
0x45ff80100a6b800fddc000b2def0018004b66.........-....Kf
0x4600800c700236a3600dd00e4001700a043db...#j6........C.
0x46018002da400a094004ff200e514f6002700.-.....O......'.
0x460285600858666002563d2002200e600e500V...f.%c..".....
0x4603832000dd8006d54004b007000693000ec2....mT.K.p.i0..
0x46048d900a8164b006600588700f600adf0f9....K.f.X.......
0x4605800f45d2900a18c00d1ddb400d6fa00db..])............
0x46068e57e00db008c372f0040149f00f2af24.~....7/.@.....$
0x4607800b600d1003200cb00663d003300ef97.....2...f=.3...
PE version resource structure 0x61a46–0x61a76
0x61a4600000000000000000000dc0234000000............4...
0x61a56560053005f0056004500520053004900V.S._.V.E.R.S.I.
0x61a664f004e005f0049004e0046004f000000O.N._.I.N.F.O...
0x61a760000bd04effe00000100b200050000 ...............
PE FileVersion metadata field 0x61b1a–0x61c2a
⋯3 more rows
0x61b4a4a0077005600420065004f0000003400J.w.V.B.e.O...4.
0x61b5a0a000100460069006c00650056006500....F.i.l.e.V.e.
0x61b6a7200730069006f006e00000000003500r.s.i.o.n.....5.
0x61b7a2e003100370038002e00360030003200..1.7.8...6.0.2.
0x61b8a00003c000e00010049006e0074006500..<.....I.n.t.e.
0x61b9a72006e0061006c004e0061006d006500r.n.a.l.N.a.m.e.
0x61baa00007a006f006100690071006c006b00..z.o.a.i.q.l.k.
0x61bba690078002e0065007800650000003800i.x...e.x.e...8.
0x61bca0a000100500072006f00640075006300....P.r.o.d.u.c.
0x61bda7400560065007200730069006f006e00t.V.e.r.s.i.o.n.
0x61bea000035002e003100370038002e003600..5...1.7.8...6.
⋯4 more rows

No evidence locations were recorded for this file. Raw result

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.