Benign pe-machine-learning-dataset Download

26702

Signed legitimate installer

Authenticode chain CN: Krab WebPE manifest requests admin

SHA-256684bba5ce1e19c3eb965a18978c45f765ee2bfd16c1dd4dd1747db2dfa89296b

MaleculeO₃(AsCP)H₇(Cm₃Db₂F₂Os₁₂Po₄TiU)Md₆(Bi₅BkPaPtSi₄)

Evidence

x86 indirect call through a global pointer 0x1855–0x1915

⋯3 more rows
0x18850085c07408ff15fc4041008bf8ff75a8[email protected].
0x18958b35e8404100ffd6ff75acffd68bc75f[email protected]....._
0x18a55e8b4dfc33cde82a6300008be55dc3ff^.M.3..*c....]..
⋯7 more rows

Inline MZ header validation constant 0x8ad7–0x8bb7

⋯3 more rows
0x8b07e8715200000fb7f06a02e88963000059.qR.....j...c..Y
0x8b17b84d5a000066390500004000740433db[email protected].
0x8b27eb33a13c00400081b800004000504500.3.<.@[email protected].
0x8b370075ebb90b0100006639881800400075[email protected]
0x8b47dd33db83b8740040000e76093998e800[email protected]...
⋯7 more rows

In-code MZ/PE compare immediate 0x10ec7–0x10f97

⋯3 more rows
0x10ef7e55dc3cccccccccccc558bec8b4508b9.].......U...E..
0x10f074d5a0000663908740433c05dc38b483cMZ..f9.t.3.]..H<
0x10f1703c833c0813950450000750cba0b0100..3..9PE..u.....
0x10f2700663951180f94c05dc3558bec8b4508.f9Q....].U...E.
⋯7 more rows

Binary imports ADVAPI32.dll 0x12860–0x12b50

⋯3 more rows
0x1289000000000000000000000000000000000................
0x128a041006400760061007000690033003200A.d.v.a.p.i.3.2.
0x128b02e0064006c006c00000000005265674f..d.l.l.....RegO
0x128c070656e4b65795472616e736163746564penKeyTransacted
0x128d0570000005265674372656174654b6579W...RegCreateKey
0x128e05472616e736163746564570052656744TransactedW.RegD
0x128f0656c6574654b65795472616e73616374eleteKeyTransact
0x129006564570052656744656c6574654b6579edW.RegDeleteKey
0x1291045785700409641001024400010214000[email protected]..$@..!@.
⋯7 more rows
0x12990000000000000000053004f0046005400........S.O.F.T.
0x129a057004100520045005c0043006c006100W.A.R.E.\.C.l.a.
0x129b073007300650073005c0043004c005300s.s.e.s.\.C.L.S.
0x129c0490044005c007b003100410041003600I.D.\.{.1.A.A.6.
0x129d030003000350034002d003500370044000.0.5.4.-.5.7.D.
0x129e039002d0034004600390039002d0039009.-.4.F.9.9.-.9.
0x129f04100350035002d004400300046004200A.5.5.-.D.0.F.B.
0x12a0046004200450037004500430044003300F.B.E.7.E.C.D.3.
0x12a107d0000000000000053004f0046005400}.......S.O.F.T.
0x12a2057004100520045005c004d0069006300W.A.R.E.\.M.i.c.
0x12a3072006f0073006f00660074005c005700r.o.s.o.f.t.\.W.
0x12a4069006e0064006f00770073005c004300i.n.d.o.w.s.\.C.
0x12a5075007200720065006e00740056006500u.r.r.e.n.t.V.e.
⋯4 more rows
0x12aa053004f00460054005700410052004500S.O.F.T.W.A.R.E.
0x12ab05c0043006c0061007300730065007300\.C.l.a.s.s.e.s.
0x12ac05c0043004c005300490044005c007b00\.C.L.S.I.D.\.{.
0x12ad0340041004100340036004400340039004.A.A.4.6.D.4.9.
0x12ae02d0034003500390046002d0034003300-.4.5.9.F.-.4.3.
⋯7 more rows

References CLSID registry path only 0x12b91–0x12c71

⋯3 more rows
0x12bc1004f004600540057004100520045005c.O.F.T.W.A.R.E.\
0x12bd10043006c00610073007300650073005c.C.l.a.s.s.e.s.\
0x12be10043004c005300490044005c007b0065.C.L.S.I.D.\.{.e
0x12bf10035003600610065006400330030002d.5.6.a.e.d.3.0.-
0x12c010066003600640066002d003400660033.f.6.d.f.-.4.f.3
⋯7 more rows