Benign Download

Trojan.Win32.P2E.ah

PE section headers declare sizes beyond end of fileReferences the Windows debugger output API
SHA-2567aab8978d6ac099d7f93bcbe3f7d371d37309f47da1c915fdcb897a35762e25e
MaleculeH(Po₂)Md(Bi)

Evidence

Execute shell command (ShellExecuteA) 0x1420c–0x143ac
⋯3 more rows
0x1423c96000080020000800700008008000080................
0x1424c000000002a7b01003a7b0100187b0100....*{..:{...{..
0x1425c00000000c2780100f67801003c780100.....x...x..<x..
0x1426cfc77010016780100287801001a790100.w...x..(x...y..
⋯20 more rows
References the Windows debugger output API 0x17376–0x17446
⋯3 more rows
0x173a60000b0036c7374726361744100008302....lstrcatA....
0x173b64f75747075744465627567537472696eOutputDebugStrin
0x173c6674100002e00436c6f736548616e646cgA....CloseHandl
0x173d66500850357616974466f7253696e676ce...WaitForSingl
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.