Benign Download

Trojan-PSW.Win32.Delf.kg

Detects an XORed URL in an executableEncoded content decoded: xor
SHA-25669894fa150f3bcf4ca9de2af271cf0bd433f69423a57251239de75ecbb81ddd3
MaleculeMdTh

Evidence

Detects an XORed URL in an executable 0xffd0–0x100a0
⋯3 more rows
0x100005e5b8be55dc20400ffffffff07000000^[..]...........
0x10010e8f4f4f0baafaf00ffffffff08000000................
0x10020e8f4f4f0f3baafaf00000000ffffffff................
0x10030020000000d0a0000ffffffff06000000................
⋯7 more rows
Encoded content decoded: xor 0x111c0–0x11350
⋯3 more rows
0x111f08a3e00c04fc9e26effffffff3d000000.>..O..n....=...
0x11200e8f4f4f0baafaff3e5f2f6e9e3e5aeb1................
0x11210b0b0b0f9aee3efedaee3eeafb1b0b0b0................
0x11220f9afb1b0b0b0d9d3e5f2f6e9e3e5afd0................
0x11230e1f3f3d3e5e1f2e3e8aee1f3f0000000................
⋯7 more rows
0x112b00100000023000000ffffffff02000000....#...........
0x112c00d0a0000ffffffff2800000068747470........(...http
0x112d03a2f2f74772e6d792e636c75622e7961://tw.my.club.ya
0x112e0686f6f2e636f6d2f6d792f6d79636c75hoo.com/my/myclu
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.