Benign Download

P2P-Worm.Win32.Socks.fc

Detects an XORed URL in an executableEncoded content decoded: xor
SHA-256981b1f97d6a1eed2d2b96b12308b787037fe278dd35837df230f5bd537fa9d3e
MaleculeMdTh

Evidence

Encoded content decoded: xor 0x623d–0x631d
⋯3 more rows
0x626d0202020c1db80c02b60bcf23ba034ecf...........#..N.
0x627d23566a6b712272706d6570636f226163#Vjkq"rpmepco"ac
0x628d6c6c6d762260672270776c226b6c2246llmv"`g"pwl"kl"F
0x629d4d51226f6d66672c0f0f082602020202MQ"omfg,...&....
0x62ad020202cb2686e98f47e8ba8f47e8ba8f....&...G...G...
⋯7 more rows
Detects an XORed URL in an executable 0x74c8–0x7588
⋯3 more rows
0x74f801da47f0d83dab72ddd693678d895777..G..=.r...g..Ww
0x75086a767672382d2d7575752c7176637676jvvr8--uuu,qvcvv
0x75186d712c616d6f2d76636b6e2d00000000mq,amo-vckn-....
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.