Benign Download

Trojan-Downloader.Win32.Obfuscated.hfu

IsDebuggerPresent API name in PE stringsReferences the IsDebuggerPresent API
SHA-256899b13a6dc69356d5f7856abe83a31f961b215292efbc6e02e5ffe9c200032f2
MaleculeH(Po₂)Md(Bi)

Evidence

High-entropy read-only .rdata section 0x2dfc0–0x2e0a0
⋯3 more rows
0x2dff000000000000000000000000000000000................
0x2e0001c1004002a1004003a1004004c100400....*...:...L...
0x2e0106010040070100400821004009a100400`...p...........
0x2e020a8100400c6100400d4100400e6100400................
0x2e030fe100400101104001e11040030110400............0...
⋯7 more rows
References the IsDebuggerPresent API 0x2e214–0x2e354
⋯3 more rows
0x2e2441b1a0400271a0400391a04004b1a0400....'...9...K...
0x2e254611a0400751a0400811a04009b1a0400a...u...........
0x2e264af1a0400c51a0400cf1a0400df1a0400................
0x2e274f31a0400031b0400151b0400271b0400............'...
⋯14 more rows
References the Windows debugger output API 0x418ad–0x4197d
⋯3 more rows
0x418dd757272656e7454687265616400008102urrentThread....
0x418ed4f75747075744465627567537472696eOutputDebugStrin
0x418fd67410000af004578697450726f636573gA....ExitProces
0x4190d7300da01476574557365724465666175s...GetUserDefau
⋯7 more rows
IsDebuggerPresent API name in PE strings 0x41a23–0x41af3
⋯3 more rows
0x41a537244656661756c744c43494400002f02rDefaultLCID../.
0x41a634973446562756767657250726573656eIsDebuggerPresen
0x41a73740013024765744f454d43500000ee00t...GetOEMCP....
0x41a8346726565456e7669726f6e6d656e7453FreeEnvironmentS
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.