Benign Download

Trojan-Proxy.Win32.Puma.r

Detects an XORed URL in an executableEmbedded PE binary at file offset 0xa70 (~18832 bytes)
SHA-2569ec87671df50878035864ef92b327fb7eec7daf9d262e91a3b8bb54c0139ae32
MaleculeTh

Evidence

Embedded PE binary at file offset 0xa70 (~18832 bytes) 0xa30–0xb00
⋯3 more rows
0xa6041000000000000000000000000000000A...............
0xa704d5a90000300000004000000ffff0000MZ..............
0xa80b8000000000000004000000000000000........@.......
0xa9000000000000000000000000000000000................
⋯7 more rows
Detects an XORed URL in an executable 0x3473–0x3533
⋯3 more rows
0x34a325575b7964685b6a656a668005e0596a%W[ydh[jejf...Yj
0x34b3736f6f6b2134346c02801a03356b7a75sook!44l....5kzu
0x34c37a233578753469632e2310b886c4357az#5xu4ic.#....5z
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.