Suspicious 80% Download

Backdoor.Win32.Poison.sso

Named backdoor, anti-analysis APIs

PE could not be identified by filefactsIsDebuggerPresent API name in PE strings
SHA-2568495ae705fea2ada0609b45f6a58076b22a4d386bbd97feec99fdef81bc1391d
MaleculeO(Al)H(Po₂)

Evidence

PE could not be identified by filefacts 0x0–0xe0
0x04d5a90000300000004000000ffff0000MZ..............
0x10b8000000000000000100000000000000................
0x2000000000000000000000000000000000................
0x30000000000000000000000000b8000000................
⋯11 more rows
References the Windows debugger output API 0x3238–0x3308
⋯3 more rows
0x3268b890101001ffd0ffe000000013000000................
0x32784f75747075744465627567537472696eOutputDebugStrin
0x328867410000842e10017832100100000400gA......x2......
0x329870f910010000000000000000a178f910p............x..
⋯7 more rows
IsDebuggerPresent API name in PE strings 0x3e58–0x3f28
⋯3 more rows
0x3e883e2301a22e1b99478d62bdcddac4fc72>#.....G.b.....r
0x3e984973646562756767657250726573656eIsdebuggerPresen
0x3ea874000000437075436c6b000038006400t...CpuClk..8.d.
0x3eb8010001000000000040000500ffffffff........@.......
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.