Suspicious 80% Download

Trojan-Downloader.Win32.Agent.gd

Trojan downloader with injection APIs

Large PE is dominated by zero-like fillerCreateRemoteThread API reference
SHA-256a3f8832370bc574c89cc656d0b466c9762dec9d07af21de31ee813b2c8e1dfaf
MaleculeH(Po₂)Md(Bi)

Evidence

Large PE is dominated by zero-like filler 0x0–0xd0
0x04d5a90000300000004000000ffff0000MZ..............
0x10b8000000000000004000000000000000........@.......
0x2000000000000000000000000000000000................
⋯11 more rows
Execute shell command (ShellExecuteA) 0x1030–0x1160
⋯3 more rows
0x10606164416666696e6974794d61736b00e8adAffinityMask..
0x10709cfcffff8b02c20400e892fcffff8b4a...............J
0x10800ce302ffe1e84e010000c21400558bec......N......U..
0x1090ff7508e85901000085c074268b551485.u..Y.....t&.U..
0x10a0c9740ff7402008008030751a81ca0000.t..@ ...0u.....
0x10b00008ff751852ff7510ff750cff158010...u.R.u..u.....
0x10c01413c9c214006a0559e80d010000ebf2......j.Y.......
0x10d0558bec8d4d0c8b0185c074093d000001U...M.....t.=...
0x10e000723c2bc05268291f141364ff306489.r<+.Rh)...d.0d.
0x10f0208d4510ff7518ff7514506a0051ff75 .E..u..u.Pj.Q.u
⋯7 more rows
CreateRemoteThread API string 0x1b58–0x1c28
⋯3 more rows
0x1b8872656e7450726f636573734964004600rentProcessId.F.
0x1b9843726561746552656d6f746554687265CreateRemoteThre
0x1ba86164000026014765744d6f64756c6548ad..&.GetModuleH
0x1bb8616e646c654100005001476574537461andleA..P.GetSta
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.