Benign Download

a61a3d81066c695a27cc2e80744babe3b20c468546963a83a1c7867604c9f047.exe

Encoded payload detected: xorInline MZ and PE validation
SHA-256a61a3d81066c695a27cc2e80744babe3b20c468546963a83a1c7867604c9f047
MaleculeO(I)H(F)Md

Evidence

Inline MZ and PE validation 0x4759–0x4789
0x4759750e8b35b470400057ffd653ffd6ebdc[email protected]....
0x47696681384d5a75d58b703c68f800000003f.8MZu..p<h.....
0x4779f056ff156070400085c075c0813e5045.V..`[email protected]..>PE
0x47890000 ..
Windows Shell Folders registry path 0xa270–0xa2d0
0xa2700a20257320257300220000005c000000. %s %s."...\...
0xa280536f6674776172655c4d6963726f736fSoftware\Microso
0xa29066745c57696e646f77735c4375727265ft\Windows\Curre
0xa2a06e7456657273696f6e5c4578706c6f72ntVersion\Explor
0xa2b065725c5368656c6c20466f6c64657273er\Shell Folders
0xa2c0000000002e74746600000000466f6e74.....ttf....Font
0xa2d073000000257379736469722500000000s...%sysdir%....
Copy create file status 0xa4e8–0xa518
0xa4e873742e204372656174652069743f0000st. Create it?..
0xa4f8437265617465204469726563746f7279Create Directory
0xa5083f00000043686f6f736520616e204578?...Choose an Ex
0xa5187472616374696f6e20466f6c64657200traction Folder.
Encoded payload detected: xor 0x164df–0x1652f
0x164df00ff000000ff00ff00ffff0000ffffff................
0x164ef001b1b1b1b1b1b1b1b1b1b1b1b1b1b1b................
0x164ff1b1b1b1b191a1a1a191b1b1b1b1b1b1b................
0x1650f1b1b1b1b1b1b1b1b1b1b1b1b001b1b1b................
0x1651f1b1b1b1b1b1b1b1b1b1b1b1b1b1c1418................
0x1652f0f0f0f0f0f18141c1b1b1b1b1b1b ..............

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.