Benign Download

Trojan-GameThief.Win32.Nilage.bvz

Detects an XORed URL in an executableEncoded content decoded: xor

SHA-25694541a3fea02777e91cb2e9119a0270178f99562035999abe9ef328df14cd9eb

MaleculeMdTh

Evidence

Detects an XORed URL in an executable 0x57fc–0x58bc

⋯3 more rows
0x582ceb5f5e5b8be55dc3ffffffff07000000._^[..].........
0x583c687474703a2f2f00ffffffff01000000http://.........
0x584c2f000000558bec51b9890000006a006a/...U..Q.....j.j
⋯7 more rows

Encoded content decoded: xor 0x14cf0–0x14fe0

⋯3 more rows
0x14d206959575300000000ffffffff1e000000iYWS............
0x14d30e8f4f4f0baafaff4f7aee7e1f3e8e3e1................
0x14d40f2e4aee7e1ede1eee9e1aee3efed0000................
0x14d50ffffffff1f000000e8f4f4f0baafaff4................
0x14d60f7aee7e1f3e8e3e1f2e4aee7e1ede1ee................
0x14d70e9e1aee3efedaf00ffffffff28000000............(...
0x14d80e8f4f4f0baafaff4f7aee7e1f3e8e3e1................
0x14d90f2e4aee7e1ede1eee9e1aee3efedafe9................
0x14da0eee4e5f8aee1f3f000000000ffffffff................
0x14db02a000000e8f4f4f0f3baafaff4f7aee7*...............
0x14dc0e1f3e8aee7e1ede1eee9e1aee3efedaf................
0x14dd0c7c1d3c8ccefe7e9eeaee1f3f0f80000................
0x14de0ffffffff1b000000e8f4f4f0f3baafaf................
0x14df0f4f7aee7e1f3e8aee7e1ede1eee9e1ae................
0x14e00e3efed00ffffffff1c000000e8f4f4f0................
0x14e10f3baafaff4f7aee7e1f3e8aee7e1ede1................
0x14e20eee9e1aee3efedaf00000000ffffffff................
0x14e302a000000e8f4f4f0f3baafaff4f7aee7*...............
0x14e40efefe4ecefe3ebaee7e1ede1eee9e1ae................
0x14e50e3efedafe9eee4e5f8aee1f3f0f80000................
0x14e60ffffffff2a000000e8f4f4f0f3baafaf....*...........
0x14e70f4f7aee7efefe4ecefe3ebaee7e1ede1................
0x14e80eee9e1aee3efedafc9eee4e5f8aee1f3................
0x14e90f0f80000ffffffff2b000000e8f4f4f0........+.......
0x14ea0baafaff4f7aee7e1ede1eee9e1aee3ef................
0x14eb0edafc7c8cfcdc5afc8efede5dfc3e5ee................
0x14ec0f4e5f2aec1d3d000ffffffff16000000................
0x14ed0e8f4f4f0baafaff4f7aee7e1ede1eee9................
0x14ee0e1aee3efedaf0000ffffffff15000000................
0x14ef0e8f4f4f0baafaff4f7aee7e1ede1eee9................
0x14f00e1aee3efed000000ffffffff2e000000................
0x14f10e8f4f4f0baafaff4f7aee7e1ede1eee9................
0x14f20e1aee3efedafe4e5e6e1f5ecf4aee1f3................
0x14f30f0bff5f3e5f2dfecefe3e1f4e5bd0000................
0x14f40ffffffff26000000e8f4f4f0f3baafaf....&...........
0x14f50f4f7aee7e1f3e8aee7e1ede1eee9e1ae................
0x14f60e3efedafc2ece1eeebaee1f3f0f80000................
0x14f70ffffffff28000000e8f4f4f0baafaff4....(...........
0x14f80f7aee7e1f3e8e3e1f2e4aee7e1ede1ee................
0x14f90e9e1aee3efedaff3f0e1e3e5aee8f4ed................
0x14fa000000000ffffffff1f000000e8f4f4f0................
0x14fb0f3baafaff4f7aee7efefe4ecefe3ebae................
⋯3 more rows