Benign Download

Trojan-GameThief.Win32.Lmir.amu

Embedded PE binary at file offset 0x5304 (~50468 bytes)Detour-style InstallHook helper name
SHA-2569bd9fc5587b765c3dac58e3f91d7b9aa1cdc8f62dc53a92b91fff575ee6e4546
MaleculeO(Er)

Evidence

Detour-style InstallHook helper name 0x3794–0x3854
⋯3 more rows
0x37c4646c6c005374617274486f6f6b000000dll.StartHook...
0x37d4496e7374616c6c486f6f6b00538bd88bInstallHook.S...
0x37e4c3bafc434000e835edffff5bc3000000[email protected]...[....
⋯7 more rows
Embedded PE binary at file offset 0x5304 (~50468 bytes) 0x52c4–0x5394
⋯3 more rows
0x52f44b0041004700450049004e0046004f00K.A.G.E.I.N.F.O.
0x53044d5a50000200000004000f00ffff0000MZP.............
0x5314b80000000000000040001a0000000000........@.......
0x532400000000000000000000000000000000................
⋯7 more rows
Detour-style InstallHook helper name Trojan-GameThief.Win32.Lmir.amu · 0x3794–0x3854
⋯3 more rows
0x37c4646c6c005374617274486f6f6b000000dll.StartHook...
0x37d4496e7374616c6c486f6f6b00538bd88bInstallHook.S...
0x37e4c3bafc434000e835edffff5bc3000000[email protected]...[....
⋯7 more rows
Embedded PE binary at file offset 0x5304 (~50468 bytes) Trojan-GameThief.Win32.Lmir.amu · 0x52c4–0x5394
⋯3 more rows
0x52f44b0041004700450049004e0046004f00K.A.G.E.I.N.F.O.
0x53044d5a50000200000004000f00ffff0000MZP.............
0x5314b80000000000000040001a0000000000........@.......
0x532400000000000000000000000000000000................
⋯7 more rows
Detour-style InstallHook helper name embedded:pe@0x5304 · 0xa22e–0xa2ee
⋯3 more rows
0xa25e6c6c2e646c6c00486f6f6b50726f6300ll.dll.HookProc.
0xa26e496e7374616c6c486f6f6b0053746172InstallHook.Star
0xa27e74486f6f6b0053746f70486f6f6b0055tHook.StopHook.U
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.