Benign Download

Trojan-PSW.Win32.QQPass.ws

Detects an XORed URL in an executableEncoded content decoded: xor
SHA-25687848982070ca5c0522e637819f51e6ee788080c70e2a8ee6515a3ccb31c8a7c
MaleculeMdTh

Evidence

Detects an XORed URL in an executable 0x51fc–0x52bc
⋯3 more rows
0x522ceb5f5e5b8be55dc3ffffffff07000000._^[..].........
0x523c687474703a2f2f00ffffffff01000000http://.........
0x524c2f000000558bec81c4ccfbffff5333c9/...U........S3.
⋯7 more rows
Encoded content decoded: xor 0x6290–0x6370
⋯3 more rows
0x62c0b5d8c7f83a000000ffffffff26000000....:.......&...
0x62d06478787c362323686d637d7d2269656fdxx|6##hmc}}"ieo
0x62e07c22626978237d7d393d3e233434383a|"bix#}}9=>#448:
0x62f06a6d226d7f7c0000558bec33c9515151jm"m.|..U..3.QQQ
0x630051515356578b3d6492400033c0556820[email protected]
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.