Benign datamaliciousorder Download

Trojan.Danger_Trojan.GenericKD.67166905_384_1.vir

Detects an XORed URL in an executableEmbedded PE binary at file offset 0x1ed11 (~212992 bytes)

SHA-256a13d19fc23fcc75b73b0c84c87672aa4b3711ef0e8e8643b905943dd26798046

MaleculeMdTh

Evidence

Encoded content decoded: xor 0xfadd–0xfd1d

⋯3 more rows
0xfb0d05532b0b60302b0b60302b0b60302b0b.S+.`0+.`0+.`0+.
0xfb1d28647f5b4f01053b40021b3b40734465(d.[O..;@..;@sDe
0xfb2d0e55487f095f452b05435f6a025c4278.UH.._E+.C_j.\Bx
0xfb3d08554f066a3d210b60302bfd63302b08.UO.j=!.`0+.c0+.
0xfb4d60302bf49fcfd40f60302bf49fcfd4f4`0+.....`0+.....
⋯9 more rows
0xfbed056c6662034244780f565f5729751f0b.lfb.BDx.V_W)u..
0xfbfd08445f7b5a1f047c1747056609535964.D_{Z..|.G.f.SYd
0xfc0d135f4d7f4e5344664f59586a10590479._M.NSDfOYXj.Y.y
0xfc1d055442794e5447675f40596f5d594e2d.TByNTGg_@Yo]YN-
0xfc2d0142166205434e6a1253430b0152447e.B.b.CNj.SC..RD~
0xfc3d140a4967015e400b1754447160585f7f..Ig.^@..TDq`X_.
0xfc4d100a0424061f5c680d540563145d2b63...$..\h.T.c.]+c
0xfc5d14445b314f1f4d24104058670f57057b.D[[email protected].{
0xfc6d08402b6314445b314f1f4d2410595b67.@+c.D[1O.M$.Y[g
0xfc7d0f57057b0840142e130a0e625a154231.W.{[email protected]
0xfc8d4543112e50095e314559112e50024f31EC..P.^1EY..P.O1
0xfc9d4500196f5a151b39043051711a307c42E..oZ..9.0Qq.0|B
0xfcad2e74645125622b57025c49605302056f.tdQ%b+W.\I`S..o
⋯7 more rows

Encoded content decoded: xor → base64 0x103c2–0x10492

⋯3 more rows
0x103f2307b790f534e781303194d0942587f600{y.SNx...M.BX.`
0x1040273596e01444e5f0f5f4763055c5b3852sYn.DN_._Gc.\[8R
0x1041263456a104343641430604e327e6e4753cEj.CCd.0`N2~nGS
0x1042202054f2c7c2b3e50000b5b4d7559790f..O,|+>P..[MuYy.
⋯7 more rows

Detects an XORed URL in an executable 0x12687–0x12747

⋯3 more rows
0x126b7656e7420796f7520726571756573740aent you request.
0x126c7687474703a2f2f6f7261636c652e636fhttp://oracle.co
0x126d76d2f636f6e7472616374732c20616e64m/contracts, and
⋯7 more rows

Embedded PE binary at file offset 0x1ed11 (~212992 bytes) 0x1ecd1–0x1eda1

⋯3 more rows
0x1ed015850585e50005a50515e00110100002aXPX^P.ZPQ^.....*
0x1ed114d5a90000300000004000000ffff0000MZ..............
0x1ed21b8000000000000004000000000000000........@.......
0x1ed3100000000000000000000000000000000................
⋯7 more rows