Suspicious 80% Download

Trojan-Downloader.Win32.Alphabet.eq

Named Trojan-Downloader, PE anomalies

PE directories in mismatched sectionsPE entry point in .reloc section
SHA-256697eefb54559f85270c18ffdc1cea2f07048775b404582c580a850560e69264a
MaleculeMd(Bi₃)

Evidence

PE directories in mismatched sections 0x0–0xe0
0x04d5a90000300000004000000ffff0000MZ..............
0x10b8000000000000004000000000000000........@.......
0x2000000000000000000000000000000000................
0x3000000000000000000000000020010000............ ...
⋯11 more rows
High-entropy read-only .rdata section 0x3c0–0x4a0
⋯3 more rows
0x3f000000000000000000000000000000000................
0x4005b4900000080ff1fb01892d0f7d74600[I............F.
0x4100000003d4d9b7f315204cd0836f74836...=M..1R...6.H6
0x420e633390e44b4f6a8584dd7b7eb9a08a2.39.D...XM......
0x430dcfe9fc3b000002540869d6df987858d.......%@..m....
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.