Suspicious 85% pe-machine-learning-dataset Download

47812

NOP sleds and debugger detection

Authenticode chain CN: Stanislav KabinSigned by Stanislav Kabin
SHA-256a7b53180c8e2801b1c7eca994d3718ca3bc0af33c9b1793e72f801323e379ba9
MaleculeO₂(Al₃As)H₃(CmDsPo)Md₂(BiSi₂)

Evidence

Repeated NOP-run pattern in executable section 0x4c51–0x4ca1
0x4c5100e9efffffff6843010000e9dbffffff......hC........
0x4c6190909090909090909090909090909090................
0x4c71908b450821a42470017400b860214700..E.!.$p.t..`!G.
0x4c81899f247f7b834ac70fde3354ee21e452..$.{.J...3T.!.R
0x4c91444a34f701aae950ff03b989814b5051DJ4....P.....KPQ
0x4ca14c24f20fd81dda0000e91e62a800ab L$.........b...
Long NOP sled byte sequence 0x3a86a–0x3a8ea
0x3a86affff81ec8c00000089c089db89c989d2................
0x3a87a90909090909090909090909090909090................
0x3a88a90909090909090909090909090909090................
0x3a89a90909090909090909090909090909090................
0x3a8aa90909090909090900fb7450c6689c18b..........E.f...
0x3a8ba45108b55088984248000000066894c24E..U...$....f.L$
0x3a8ca7e89542478c744247400000000c74424~.T$x.D$t.....D$
0x3a8da7000000000c744246c000000008b8424p.....D$l......$
0x3a8ea8000000089442468c7442464000000 .....D$h.D$d...
Dynamic library loading via LoadLibraryW 0x4cff0–0x4d120
0x4cff06e6b570053657444656661756c74446cnkW.SetDefaultDl
0x4d0006c4469726563746f7269657300000000lDirectories....
0x4d010456e756d53797374656d4c6f63616c65EnumSystemLocale
0x4d02073457800436f6d70617265537472696esEx.CompareStrin
0x4d0306745780047657444617465466f726d61gEx.GetDateForma
0x4d040744578004765744c6f63616c65496e66tEx.GetLocaleInf
0x4d0506f45780047657454696d65466f726d61oEx.GetTimeForma
0x4d06074457800476574557365724465666175tEx.GetUserDefau
0x4d0706c744c6f63616c654e616d6500000000ltLocaleName....
0x4d080497356616c69644c6f63616c654e616dIsValidLocaleNam
0x4d090650000004c434d6170537472696e6745e...LCMapStringE
0x4d0a07800000047657443757272656e745061x...GetCurrentPa
0x4d0b0636b6167654964000000000000000000ckageId.........
0x4d0c000000000000000000000000000000000................
0x4d0d000000000000000000000000000000000................
0x4d0e000000000000000000000000000000000................
⋯4 more rows
Debugger detection via Windows API 0x50324–0x50364
0x503247450726f636573734865617000008303tProcessHeap....
0x503344973446562756767657250726573656eIsDebuggerPresen
0x5034474003c01456e636f6465506f696e7465t.<.EncodePointe
0x50354720017014465636f6465506f696e7465r...DecodePointe
0x5036472 r
URL using .xyz top-level domain 0x51e3a–0x51e7a
0x51e3a0000000000000000000001e716000000................
0x51e4a8f939397ddc8c88b8e8182948c9ed580................
0x51e5a8293c99f9e9d00000000000000000000................
0x51e6a00000000000000000000000000000000................
0x51e7a000000000000 ......

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.