Hostile ^92% pe-machine-learning-dataset Download

31791

Embedded packed installer binary

Unsigned PE writable entry with multiple RWX sectionsBlank-named high-entropy executable section

SHA-256a1af839eea07d78c020c26d4d9825402c0d73a0618b2980fbf8fdd897c1d5934

MaleculeO(As₅)H₅(Cm₂Db₂DsOs₅Po₂)Md₃(Bi₉PaSi)

Evidence

English function-word token "this" 0x0–0xe0

0x04d5a90000300000004000000ffff0000MZ..............
0x10b8000000000000004000000000000000........@.......
0x2000000000000000000000000000000000................
0x30000000000000000000000000e8000000................
0x400e1fba0e00b409cd21b8014ccd215468........!..L.!Th
0x5069732070726f6772616d2063616e6e6fis program canno
⋯9 more rows

Embedded absolute PDB path 0x19d0–0x1ac0

⋯3 more rows
0x1a00ef681242bec45044ee845fd701000000.h.B..PD.._.....
0x1a104f3a5c75676e7838305c697032355c77O:\ugnx80\ip25\w
0x1a206e746933325c7064625c617474726962nti32\pdb\attrib
0x1a307574655f7365745f5f5f313331323531ute_set___131251
0x1a40393038382e70646200000000000000009088.pdb........
0x1a50e91d0000000000000000000000000000................
⋯7 more rows

IsDebuggerPresent API name in PE strings 0x2016–0x2126

⋯3 more rows
0x2046696d65417346696c6554696d6500c004imeAsFileTime...
0x20565465726d696e61746550726f63657373TerminateProcess
0x20660000c00147657443757272656e745072....GetCurrentPr
0x20766f6365737300d304556e68616e646c65ocess...Unhandle
0x208664457863657074696f6e46696c746572dExceptionFilter
0x209600000003497344656275676765725072....IsDebuggerPr
0x20a66573656e74004b45524e454c33322e64esent.KERNEL32.d
0x20b66c6c000000000000000000000000b073ll.............s
⋯7 more rows

PE version metadata includes CompanyName 0x25e0–0x28d0

⋯7 more rows
0x265000000000000000000000000000000000................
0x2660100334000000560053005f0056004500..4...V.S._.V.E.
0x26705200530049004f004e005f0049004e00R.S.I.O.N._.I.N.
⋯6 more rows
0x26e04a020000010030003400300039003000J.....0.4.0.9.0.
0x26f0340062003000000086003300010043004.b.0.....3...C.
0x27006f006d00700061006e0079004e006100o.m.p.a.n.y.N.a.
0x27106d006500000000005300690065006d00m.e.....S.i.e.m.
⋯5 more rows
0x27706500200049006e0063002e0000000000e. .I.n.c.......
0x278042000d000100460069006c0065004400B.....F.i.l.e.D.
0x279065007300630072006900700074006900e.s.c.r.i.p.t.i.
0x27a06f006e00000000004e00580020004300o.n.....N.X. .C.
0x27b06f006d0070006f006e0065006e007400o.m.p.o.n.e.n.t.
0x27c000000000320009000100460069006c00....2.....F.i.l.
0x27d06500560065007200730069006f006e00e.V.e.r.s.i.o.n.
0x27e00000000038002e0030002e0030002e00....8...0...0...
0x27f032003500000000003c000e00010049002.5.....<.....I.
0x28006e007400650072006e0061006c004e00n.t.e.r.n.a.l.N.
0x281061006d00650000006100740074007200a.m.e...a.t.t.r.
⋯10 more rows
0x28c065005f00730065007400000026000300e._.s.e.t...&...
0x28d00100500072006f006400750063007400..P.r.o.d.u.c.t.

Blank-named high-entropy executable section 0x2da0–0x2ee0

⋯5 more rows
0x2df000000000000000000000000000000000................
0x2e00558bec81ec8400000064ff3530000000U........d.50...
0x2e10588945dcc745ec00b60300c745cc433aX.E..E......E.C:
0x2e205c32c745d065366134c745d43966362e\2.E.e6a4.E.9f6.
0x2e30c745d8657865008b45dc8b400c8b401c.E.exe..E..@..@.
⋯11 more rows