Suspicious ^80% pe-machine-learning-dataset Download

22794

Browser hijacker updater behavior

Authenticode chain CN: LinkuryDefault search engine, provider or URL key

SHA-2566b566f500d7fc4c7b65c96d49e060049b51e5b9f976d356505e0acfce5114ec8

MaleculeO₂(CDy)H₆(Cm₃Db₃F₂OsPo₃U)Md₅(Bi₅PaPtSi₄)

Evidence

Code entropy is 7.5 or lower 0x2f88–0x3048

0x2f88050e00706fbe00000aa5350000012a4a...po.....5...*J
0x2f980272050e0070038c350000016fbf0000.r...p..5...o...
0x2fa80a2a56736200000628c000000a740c00.*Vsb...(....t..
0x2fb8000280290000042a1e0228c100000a2a...)...*..(....*
0x2fc842534a4201000100000000000c000000BSJB............
0x2fd876322e302e3530373237000000000500v2.0.50727......
0x2fe86c0000004c160000237e0000b8160000l...L...#~......
0x2ff8001f000023537472696e677300000000....#Strings....
0x3008b83500005c0e00002355530014440000.5..\...#US..D..
0x301810000000234755494400000024440000....#GUID...$D..
0x3028c809000023426c6f6200000000000000....#Blob.......
0x303802000001571da2090902000000fa2533....W.........%3
0x304800160000                        ....            

mscorlib reference 0x47dc–0x489c

0x47dc6e6773004c696e6b7572792e5265736fngs.Linkury.Reso
0x47ec75726365732e53657442726f77736572urces.SetBrowser
0x47fc7353657474696e67734175746f557064sSettingsAutoUpd
0x480c617465722e50726f7065727469657300ater.Properties.
0x481c6d73636f726c69620053797374656d00mscorlib.System.
0x482c4f626a656374004d756c746963617374Object.Multicast
0x483c44656c656761746500456e756d005379Delegate.Enum.Sy
0x484c7374656d2e436f6e6669677572617469stem.Configurati
0x485c6f6e004170706c69636174696f6e5365on.ApplicationSe
0x486c7474696e677342617365007372627500ttingsBase.srbu.
0x487c536d6172746261722e5265736f757263Smartbar.Resourc
0x488c65732e42726f777365725574696c7300es.BrowserUtils.
0x489c42726f7773657255                BrowserU        

WinForms Timer control token 0x49d0–0x4a90

0x49d07300737270646d0050726f6365737344s.srpdm.ProcessD
0x49e06f776e4d6f6e69746f720070726f6365ownMonitor.proce
0x49f07373446f776e4d6f6e69746f72730053ssDownMonitors.S
0x4a00797374656d2e546872656164696e6700ystem.Threading.
0x4a1054696d65720062726f77736572506172Timer.browserPar
0x4a20616d657465724368616e676550726f70ameterChangeProp
0x4a3065727469657354696d65727300737461ertiesTimers.sta
0x4a40727442726f7773657252657374617274rtBrowserRestart
0x4a5050646d54687265616454696d65720073PdmThreadTimer.s
0x4a607461727442726f77736572496e737461tartBrowserInsta
0x4a706c6c436865636b54687265616454696dllCheckThreadTim
0x4a8065720053797374656d2e54696d657273er.System.Timers
0x4a900062726f77                      .brow           

Default search engine, provider or URL key 0x56ce–0x579e

0x56ce75626c697368657244656661756c7473ublisherDefaults
0x56de006b696c6c42726f7773657200736574.killBrowser.set
0x56ee486f6d65706167650073657441646472Homepage.setAddr
0x56fe65737362617253656172636800736574essbarSearch.set
0x570e44656661756c74536561726368456e67DefaultSearchEng
0x571e696e650073657442726f777365725365ine.setBrowserSe
0x572e7474696e677353696c656e746c790073ttingsSilently.s
0x573e65744e657754616200696e7374616c6cetNewTab.install
0x574e457874656e73696f6e007265496e7374Extension.reInst
0x575e616c6c457874656e73696f6e00726545allExtension.reE
0x576e6e61626c65457874656e73696f6e0072nableExtension.r
0x577e656672657368457874656e73696f6e00efreshExtension.
0x578e706572666f726d526f6c6c6261636b00performRollback.
0x579e726f6c                          rol             

.NET RegistryKey type reference 0x5b41–0x5c01

0x5b413e625f5f31003c496e69743e625f5f32>b__1.<Init>b__2
0x5b51003c496e69743e625f5f33003c496e69.<Init>b__3.<Ini
0x5b61743e625f5f34004d6963726f736f6674t>b__4.Microsoft
0x5b712e57696e333200526567697374727900.Win32.Registry.
0x5b8152656769737472794b65790043757272RegistryKey.Curr
0x5b91656e7455736572004f70656e5375624bentUser.OpenSubK
0x5ba165790047657456616c756500546f5374ey.GetValue.ToSt
0x5bb172696e6700537472696e6700546f4c6fring.String.ToLo
0x5bc1776572006f705f457175616c69747900wer.op_Equality.
0x5bd1456e756d657261746f7200476574456eEnumerator.GetEn
0x5be1756d657261746f72006765745f437572umerator.get_Cur
0x5bf172656e7400416464004d6f76654e6578rent.Add.MoveNex
0x5c01740049446973706f736162          t.IDisposab     