Benign Download

Trojan.Win32.Obfuscated.vgr

IsDebuggerPresent API name in PE stringsReferences the IsDebuggerPresent API
SHA-256ad5de2ab9c82fb94fcdb0317151b633256ec9b4cffb22402045d3d281036921b
MaleculeH(Po₂)Md(Bi)

Evidence

High-entropy read-only .rdata section 0x525c0–0x526a0
⋯3 more rows
0x525f000000000000000000000000000000000................
0x526006cdc05008adc05009edc0500b0dc0500l...............
0x52610c2dc0500d4dc0500f0dc050000dd0500................
0x526201cdd05002cdd05003add05004cdd0500....,...:...L...
0x5263066dd050080dd050094dd0500a2dd0500f...............
⋯7 more rows
References the IsDebuggerPresent API 0x5410c–0x5424c
⋯10 more rows
0x541acf4770a3e0c41d6890d1295fd2287bf02.w.>.A......"...
0x541bcafecb388078ef37bd31d87cd0242cd26.......{.....B.&
0x541cc5441a55fa4e975242a2b829a7dcdf969TA._..u$*+..}..i
0x541dc98389ee2b05ed34403f13c13f2a73c0a.8...^.D..<...<.
⋯7 more rows
IsDebuggerPresent API name in PE strings 0x5ca61–0x5cb31
⋯3 more rows
0x5ca9169746963616c53656374696f6e002f02iticalSection./.
0x5caa14973446562756767657250726573656eIsDebuggerPresen
0x5cab1740069014765744c6173744572726f72t.i.GetLastError
0x5cac10000b10147657453746448616e646c65....GetStdHandle
⋯7 more rows
References the Windows debugger output API 0x5cbbb–0x5cc8b
⋯3 more rows
0x5cbeb4c6f61645265736f7572636500008202LoadResource....
0x5cbfb4f75747075744465627567537472696eOutputDebugStrin
0x5cc0b675700005403546c73416c6c6f630000gW..T.TlsAlloc..
0x5cc1b0801476574436f6d6d616e644c696e65..GetCommandLine
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.