Hostile ^92% pe-machine-learning-dataset Download

57942

Embedded packed installer payload

Four-section PE with opaque high-entropy codeBinary appears to be packed

SHA-25692aea1c4e6526ee3d8cd7173c13e8d71569ecf0e86d19995c8fbaddb39937500

MaleculeO₃(As₃DyEr)H₄(MgOs₃PoU)Md₄(Bi₆PaPtSi)

Evidence

English function-word token "this" 0x0–0xe0

0x04d5a90000300000004000000ffff0000MZ..............
0x10b8000000000000004000000000000000........@.......
0x2000000000000000000000000000000000................
0x30000000000000000000000000e8000000................
0x400e1fba0e00b409cd21b8014ccd215468........!..L.!Th
0x5069732070726f6772616d2063616e6e6fis program canno
⋯9 more rows

Microsoft Visual string 0xab0–0xb90

⋯3 more rows
0xae06e6f74206c6f616465640d0a00000000not loaded......
0xaf04d6963726f736f66742056697375616cMicrosoft Visual
0xb0020432b2b2052756e74696d65204c6962 C++ Runtime Lib
0xb1072617279000000000a0a00002e2e2e00rary............
0xb203c70726f6772616d206e616d6520756e<program name un
⋯7 more rows

Modify memory page protection 0xfd0–0x1210

0xfd010001000810181018101810181018101................
0xfe001010101010101010101010101010101................
0xff001010101010101010101010101010101................
0x100001010101010101011000100010001000................
0x101010001000820182018201820182018201................
0x102002010201020102010201020102010201................
0x103002010201020102010201020102010201................
0x104002010201020102011000100010001000................
0x105020002000200020002000200020002000 . . . . . . . .
0x106020002000200020002000200020002000 . . . . . . . .
0x107020002000200020002000200020002000 . . . . . . . .
0x108020002000200020002000200020002000 . . . . . . . .
0x109020004800100010001000100010001000 .H.............
0x10a010001000100010001000100010001000................
0x10b010001000100014001400100010001000................
0x10c010001000140010001000100010001000................
0x10d010000101010101010101010101010101................
0x10e001010101010101010101010101010101................
0x10f001010101010101010101010101010101................
0x110010000101010101010101010101010101................
0x111002010201020102010201020102010201................
0x112002010201020102010201020102010201................
0x113002010201020102010201020102010201................
0x114010000201020102010201020102010201................
0x115002010101000000000000000000000000................
0x116000000000000000000000000000000000................
0x117000000000000000000000000000000000................
0x118000000000000000000000000000000000................
⋯9 more rows

Embedded absolute PDB path 0x14c8–0x15f8

⋯3 more rows
0x14f84e423130000000004132df4101000000NB10....A2.A....
0x1508653a5c6864617564696f5c7372763033e:\hdaudio\srv03
0x15185c736f757263655c647269766572735c\source\drivers\
0x15286f656d5c7372635c77646d5c61756469oem\src\wdm\audi
0x15386f5c647269766572735c686461756469o\drivers\hdaudi
0x15486f5c686461756470726f7073686f7274o\hdaudpropshort
0x15586375745c6f626a6672655f776e65745fcut\objfre_wnet_
0x15687838365c693338365c48444153686375x86\i386\HDAShcu
0x1578742e70646200000020440000c85e0000t.pdb... D...^..
0x158800000000000000008b4424085333db85.........D$.S3..
⋯7 more rows

Writable and exe section (W^X violation) 0xf1a0–0xf2d0

⋯5 more rows
0xf1f000000000000000000000000000000000................
0xf200558bec81ec8c00000064a13000000089U........d.0....
0xf21045d8c745e800b60300c745c4433a5c30E..E......E.C:\0
0xf220c745c839663937c745cc3766662ec745.E.9f97.E.7ff..E
⋯11 more rows