Hostile 93% pe-machine-learning-dataset Download

93962

Browser hijacker, embedded payload

Mislabeled PE hides an encrypted resource and executes a shell stageRewrites start pages in unrelated browsers
SHA-256a7a3d6735111eb963cf2b24d099b6374d0fff65b42e9b7e250487bfd2745582c
MaleculeO₆(CICoAsDyPr)H₆(Cm₄Db₃F₅Os₇Po₅U)Md₄(Bi₆Bk₂PaSi₄)

Evidence

Chromium extension enable-warning pref 0x120548–0x120668
⋯3 more rows
0x120578000000006c6f636174696f6e00000000....location....
0x120588696e7374616c6c5f7761726e696e675finstall_warning_
0x1205986f6e5f656e61626c6500000031333030on_enable...1300
0x1205a8343031373434303636343130340000004017440664104...
⋯12 more rows
Firefox selected search engine preference 0x1214ed–0x1217dd
⋯3 more rows
0x12151d00610072006300680050006c00750067.a.r.c.h.P.l.u.g
0x12152d0069006e00200078006d006c006e0073.i.n. .x.m.l.n.s
0x12153d003d00270068007400740070003a002f.=.'.h.t.t.p.:./
0x12154d002f007700770077002e006d006f007a./.w.w.w...m.o.z
0x12155d0069006c006c0061002e006f00720067.i.l.l.a...o.r.g
⋯15 more rows
0x12165d46696c65206661696c65642028256429File failed (%d)
0x12166d0a00002a000000000000002200680074...*.......".h.t
0x12167d00740070003a002f002f007300650061.t.p.:././.s.e.a
0x12168d007200630068002e00620031002e006f.r.c.h...b.1...o
0x12169d00720067002f003f0062007300720063.r.g./.?.b.s.r.c
⋯7 more rows
0x12171d0022002c002000660061006c00730065.".,. .f.a.l.s.e
0x12172d0029003b000d000a0000007500730065.).;.......u.s.e
0x12173d0072005f007000720065006600280022.r._.p.r.e.f.(."
0x12174d00620072006f0077007300650072002e.b.r.o.w.s.e.r..
0x12175d007300650061007200630068002e0073.s.e.a.r.c.h...s
0x12176d0065006c006500630074006500640045.e.l.e.c.t.e.d.E
0x12177d006e00670069006e00650022002c0020.n.g.i.n.e.".,.
⋯6 more rows
Internet Explorer Main settings key 0x125e1b–0x125eeb
⋯3 more rows
0x125e4b006600740077006100720065005c004d.f.t.w.a.r.e.\.M
0x125e5b006900630072006f0073006f00660074.i.c.r.o.s.o.f.t
0x125e6b005c0049006e007400650072006e0065.\.I.n.t.e.r.n.e
0x125e7b00740020004500780070006c006f0072.t. .E.x.p.l.o.r
⋯7 more rows
Firefox startup homepage preference name 0x125f08–0x126048
⋯3 more rows
0x125f38686f6d65706167650000000000000000homepage........
0x125f4875007300650072005f00700072006500u.s.e.r._.p.r.e.
0x125f58660028002200620072006f0077007300f.(.".b.r.o.w.s.
0x125f68650072002e0073007400610072007400e.r...s.t.a.r.t.
0x125f78750070002e0068006f006d0065007000u.p...h.o.m.e.p.
0x125f8861006700650022002c00200022002500a.g.e.".,. .".%.
0x125f987300220029003b000d000a0000000000s.".).;.........
0x125fa875007300650072005f00700072006500u.s.e.r._.p.r.e.
0x125fb8660028002200620072006f0077007300f.(.".b.r.o.w.s.
0x125fc8650072002e0073007400610072007400e.r...s.t.a.r.t.
0x125fd8750070002e0068006f006d0065007000u.p...h.o.m.e.p.
⋯7 more rows
Windows uninstall registry key path string 0x1260a8–0x1262c8
⋯3 more rows
0x1260d8260063006800690064003d0063000000&.c.h.i.d.=.c...
0x1260e853004f00460054005700410052004500S.O.F.T.W.A.R.E.
0x1260f85c004d006900630072006f0073006f00\.M.i.c.r.o.s.o.
0x126108660074005c00570069006e0064006f00f.t.\.W.i.n.d.o.
0x126118770073005c0043007500720072006500w.s.\.C.u.r.r.e.
0x1261286e007400560065007200730069006f00n.t.V.e.r.s.i.o.
0x1261386e005c0055006e0069006e0073007400n.\.U.n.i.n.s.t.
0x12614861006c006c005c0049006d0070007200a.l.l.\.I.m.p.r.
0x1261586f007600650064002000730065006100o.v.e.d. .s.e.a.
0x12616872006300680020004200310000000000r.c.h. .B.1.....
0x12617853004f00460054005700410052004500S.O.F.T.W.A.R.E.
0x1261885c004d006900630072006f0073006f00\.M.i.c.r.o.s.o.
0x126198660074005c00570069006e0064006f00f.t.\.W.i.n.d.o.
0x1261a8770073005c0043007500720072006500w.s.\.C.u.r.r.e.
0x1261b86e007400560065007200730069006f00n.t.V.e.r.s.i.o.
0x1261c86e005c0055006e0069006e0073007400n.\.U.n.i.n.s.t.
0x1261d861006c006c005c0049006d0070007200a.l.l.\.I.m.p.r.
0x1261e86f007600650064002000730065006100o.v.e.d. .s.e.a.
0x1261f8720063006800000053004f0046005400r.c.h...S.O.F.T.
0x12620857004100520045005c004d0069006300W.A.R.E.\.M.i.c.
0x12621872006f0073006f00660074005c005700r.o.s.o.f.t.\.W.
0x12622869006e0064006f00770073005c004300i.n.d.o.w.s.\.C.
0x12623875007200720065006e00740056006500u.r.r.e.n.t.V.e.
0x1262487200730069006f006e005c0055006e00r.s.i.o.n.\.U.n.
0x12625869006e007300740061006c006c005c00i.n.s.t.a.l.l.\.
⋯7 more rows
Internet Explorer Main settings key 93962 · 0x125e1b–0x125eeb
⋯3 more rows
0x125e4b006600740077006100720065005c004d.f.t.w.a.r.e.\.M
0x125e5b006900630072006f0073006f00660074.i.c.r.o.s.o.f.t
0x125e6b005c0049006e007400650072006e0065.\.I.n.t.e.r.n.e
0x125e7b00740020004500780070006c006f0072.t. .E.x.p.l.o.r
⋯7 more rows
Windows uninstall registry key path string 93962 · 0x1260a8–0x1262c8
⋯3 more rows
0x1260d8260063006800690064003d0063000000&.c.h.i.d.=.c...
0x1260e853004f00460054005700410052004500S.O.F.T.W.A.R.E.
0x1260f85c004d006900630072006f0073006f00\.M.i.c.r.o.s.o.
0x126108660074005c00570069006e0064006f00f.t.\.W.i.n.d.o.
0x126118770073005c0043007500720072006500w.s.\.C.u.r.r.e.
0x1261286e007400560065007200730069006f00n.t.V.e.r.s.i.o.
0x1261386e005c0055006e0069006e0073007400n.\.U.n.i.n.s.t.
0x12614861006c006c005c0049006d0070007200a.l.l.\.I.m.p.r.
0x1261586f007600650064002000730065006100o.v.e.d. .s.e.a.
0x12616872006300680020004200310000000000r.c.h. .B.1.....
0x12617853004f00460054005700410052004500S.O.F.T.W.A.R.E.
0x1261885c004d006900630072006f0073006f00\.M.i.c.r.o.s.o.
0x126198660074005c00570069006e0064006f00f.t.\.W.i.n.d.o.
0x1261a8770073005c0043007500720072006500w.s.\.C.u.r.r.e.
0x1261b86e007400560065007200730069006f00n.t.V.e.r.s.i.o.
0x1261c86e005c0055006e0069006e0073007400n.\.U.n.i.n.s.t.
0x1261d861006c006c005c0049006d0070007200a.l.l.\.I.m.p.r.
0x1261e86f007600650064002000730065006100o.v.e.d. .s.e.a.
0x1261f8720063006800000053004f0046005400r.c.h...S.O.F.T.
0x12620857004100520045005c004d0069006300W.A.R.E.\.M.i.c.
0x12621872006f0073006f00660074005c005700r.o.s.o.f.t.\.W.
0x12622869006e0064006f00770073005c004300i.n.d.o.w.s.\.C.
0x12623875007200720065006e00740056006500u.r.r.e.n.t.V.e.
0x1262487200730069006f006e005c0055006e00r.s.i.o.n.\.U.n.
0x12625869006e007300740061006c006c005c00i.n.s.t.a.l.l.\.
⋯7 more rows
Chromium extension enable-warning pref embedded:pe:Installation_Helper_Module@0xe80a8 · 0x38480–0x385b0
⋯5 more rows
0x384d0000000006c6f636174696f6e00000000....location....
0x384e0696e7374616c6c5f7761726e696e675finstall_warning_
0x384f06f6e5f656e61626c6500000031333030on_enable...1300
0x38500343031373434303636343130340000004017440664104...
⋯11 more rows
Firefox selected search engine preference embedded:pe:Installation_Helper_Module@0xe80a8 · 0x39445–0x39735
⋯3 more rows
0x3947500610072006300680050006c00750067.a.r.c.h.P.l.u.g
0x394850069006e00200078006d006c006e0073.i.n. .x.m.l.n.s
0x39495003d00270068007400740070003a002f.=.'.h.t.t.p.:./
0x394a5002f007700770077002e006d006f007a./.w.w.w...m.o.z
0x394b50069006c006c0061002e006f00720067.i.l.l.a...o.r.g
⋯15 more rows
0x395b546696c65206661696c65642028256429File failed (%d)
0x395c50a00002a000000000000002200680074...*.......".h.t
0x395d500740070003a002f002f007300650061.t.p.:././.s.e.a
0x395e5007200630068002e00620031002e006f.r.c.h...b.1...o
0x395f500720067002f003f0062007300720063.r.g./.?.b.s.r.c
⋯8 more rows
0x396850029003b000d000a0000007500730065.).;.......u.s.e
0x396950072005f007000720065006600280022.r._.p.r.e.f.(."
0x396a500620072006f0077007300650072002e.b.r.o.w.s.e.r..
0x396b5007300650061007200630068002e0073.s.e.a.r.c.h...s
0x396c50065006c006500630074006500640045.e.l.e.c.t.e.d.E
⋯7 more rows
Firefox startup homepage preference name embedded:pe:Installation_Helper_Module@0xe80a8 · 0x3dd33–0x3e023
⋯7 more rows
0x3dda3006600740077006100720065005c004d.f.t.w.a.r.e.\.M
0x3ddb3006900630072006f0073006f00660074.i.c.r.o.s.o.f.t
0x3ddc3005c0049006e007400650072006e0065.\.I.n.t.e.r.n.e
0x3ddd300740020004500780070006c006f0072.t. .E.x.p.l.o.r
⋯11 more rows
0x3de9365706167650000000000000000750073epage........u.s
0x3dea300650072005f00700072006500660028.e.r._.p.r.e.f.(
0x3deb3002200620072006f0077007300650072.".b.r.o.w.s.e.r
0x3dec3002e0073007400610072007400750070...s.t.a.r.t.u.p
0x3ded3002e0068006f006d0065007000610067...h.o.m.e.p.a.g
0x3dee300650022002c00200022002500730022.e.".,. .".%.s."
0x3def30029003b000d000a0000000000750073.).;.........u.s
0x3df0300650072005f00700072006500660028.e.r._.p.r.e.f.(
0x3df13002200620072006f0077007300650072.".b.r.o.w.s.e.r
0x3df23002e0073007400610072007400750070...s.t.a.r.t.u.p
⋯16 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.