Suspicious 80% Download

Trojan.Win32.VB.fou

Named Trojan, evasion APIs

MZ DOS signature validation stringIsDebuggerPresent API name in PE strings
SHA-256afe66ef9ceb3caca3d64a204a0fbbf5c9fe366a1781d3e8a654aefd5ca4ce74b
MaleculeO(Er)H(Po)

Evidence

MZ DOS signature validation string 0x2f2c–0x304c
⋯5 more rows
0x2f7c7c00000002000000000000002e000000|...............
0x2f8c4d005a0020007300690067006e006100M.Z. .s.i.g.n.a.
0x2f9c740075007200650020006e006f007400t.u.r.e. .n.o.t.
⋯11 more rows
IsDebuggerPresent API name in PE strings 0x2b7dc–0x2b8ac
⋯3 more rows
0x2b80c63657074696f6e46696c746572003902ceptionFilter.9.
0x2b81c4973446562756767657250726573656eIsDebuggerPresen
0x2b82c7400a403577269746546696c6500b901t...WriteFile...
0x2b83c47657453746448616e646c6500007d01GetStdHandle..}.
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.