Hostile 92% Download

jaffacakes118_b6796344e5b8d13c52924e4f9f605b33575227d75fb910754956a0fec790e438.bin

packed, W+X, high entropy

Unsigned PE with a large anonymous section and GetProcAddressWritable entry point with invalid PE checksum
SHA-256b6796344e5b8d13c52924e4f9f605b33575227d75fb910754956a0fec790e438

Evidence

Medium PE has only short strings 0x0–0xf0
⋯3 more rows
0x30000000000000000000000000c0000000................
0x400e1fba0e00b409cd21b8014ccd215468........!..L.!Th
0x5069732070726f6772616d2063616e6e6fis program canno
0x60742062652072756e20696e20444f5320t be run in DOS
0x706d6f64652e0d0d0a2400000000000000mode....$.......
0x8046cc80f402adeea702adeea702adeea7F...............
⋯7 more rows
Large anonymous PE section 0xf80–0x1270
⋯7 more rows
0xff000000000000000000000000000000000................
0x10006801005500e801000000c3c38f487ad2h..U.........Hz.
0x1010710bbabcd0c2326ad7a7483d9b544164q.....2j..H=.TAd
0x1020bd4ebb895c1dd5d5f1499d606c050538.N..\....I.`l..8
0x103045a1b002a7f17506e7f7cb789d831562E.....u....x...b
0x10406a58049ccede5bd63e2ed91b8ee54b5ajX....[.>.....KZ
0x10504fd69d47a4f38522114e5252f9fbf5f8O..G...".NRR....
0x106012dd99662d55697d91912a97a5374bb4...f-Ui}..*..7K.
0x1070e27871162e762f31c186d425e3a52978.xq..v/1...%..)x
0x1080bbc3c7b67fc770589d7e2482bab3f7a1......pX.~$.....
0x1090b7ae7a1b7cdb3e87751521a3bffa63a8..z.|.>.u.!...c.
0x10a0e5ea3d2b3498ac91129eb77e84f685b6..=+4......~....
0x10b038fa4608cc30a0f7acbdf47208ce73d98.F..0.....r..s.
0x10c06ddc0f045af726057b42c5a32374c8a2m...Z.&.{B..#t..
0x10d0ca7a410d0754b04c82a2292c33728154.zA..T.L..),3r.T
0x10e0278b141cd532cb384cc6c5038b375141'....2.8L....7QA
0x10f08833e06f720a5e8d47dae5643e317a0b.3.or.^.G..d>1z.
0x1100c8f5547be095aba191cbd49f7236c094..T{........r6..
0x1110d7c93ede023f816c92fee22d725d9e3e..>..?.l...-r].>
0x1120f0cd837d130270f5a55b965aa0f93dda...}..p..[.Z..=.
0x1130117b993c615c8a9f9be6a070f45bdca8.{.<a\.....p.[..
0x1140fa7ca397c2cdc112fb1f56380c191948.|........V8...H
0x1150fbb1a0315aa389806cb06fa55d570e5e...1Z...l.o.]W.^
0x11609838074c77285514093adef914ec5a86.8.Lw(U..:....Z.
0x11700280ee0b51fab7d54e989b3012a4ff32....Q...N..0...2
0x1180a23bd83404508ee062b65f696ca6912e.;.4.P..b._il...
0x11907a2d506a907e2f0da4754a249a89878fz-Pj.~/..uJ$....
0x11a0ce5eb01e7ff5b1f4f9428198cac9dd2c.^.......B.....,
0x11b06f25e0ee0a3a13891e3e08ad368e140ao%...:...>..6...
0x11c0b37fe75b59253cb0da1f11b2749d0f78...[Y%<.....t..x
0x11d0c84be5134024d8a4841e7a97e3215aa2.K..@$....z..!Z.
0x11e0e54451ff33674db052bb64197cbbb015.DQ.3gM.R.d.|...
0x11f09608b335aa0be492d175c171d5f58d4b...5.....u.q...K
0x1200cfc16bcd42607041104a6a109d453808..k.B`pA.Jj..E8.
0x1210253d472ac884166c0922e62a98cb1051%=G*...l.".*...Q
0x1220eed9f482b964102b87636f658038499a.....d.+.coe.8I.
0x12303ce65f38a5824d7b1df875384e5a25d8<._8..M{..u8NZ%.
0x12400a02940bba498f9107e07f65d267b199.....I.....e.g..
0x1250c753033ba734e584b6e3b7d6fc6f514f.S.;.4.......oQO
0x126095bbba9d1c26a2202823f91118da5794.....&. (#....W.
0x127020c63ede26b0f0b26536e76fced31a52 .>.&...e6.o...R
Binary code section entropy at least 7.0 0x57fa0–0x580e0
0x57fa09d0940093862b86b3238d294bbc836e5[email protected].
0x57fb0e731ae212db324b600c8b3ab9af48034.1.!-.$........4
0x57fc029892846d0b9dcaf4fb29b7a35a908b9).(F....O..z5...
0x57fd0f0fcd2f125ddc4bc0f35c873ea9a93db....%....5.s....
0x57fe0a4a5bf3740e7862fb8525e7b62ec2c41...7@../.R^{b.,A
0x57ff0f1fedd79b72884eec608509dfe690a81...y.(....P..i..
0x580000122000000000000a3dfc9d75ff0a24a.".........._..J
0x58010dad4d4ff8f99113d44d759c13e2aa1dd.......=D.Y.>*..
0x58020749421d8cd3a11e61817aac92e22775at.!..:......."wZ
0x58030b94eab87d407a352204968f8198e1cea.N.....R Ih.....
⋯11 more rows
Writable and exe section (W^X violation) 0x581a0–0x582d0
⋯5 more rows
0x581f03dc2912e03e5cdebe1fb2ed1d7b153f1=.............S.
0x58200000000002c457e4f03002a0000000300....,E~O..*.....
0x5821003000000580000800e00000040000080....X.......@...
0x582201000000028000080000000002c457e4f....(.......,E~O
⋯11 more rows
High-entropy executable writable .data section 0x583a0–0x584d0
⋯5 more rows
0x583f03faffd0ffdd4fb250b16bbaed581a83a?......%.......:
0x584009060e803000000e9eb045d4555c3e801.`........]EU...
0x58410000000eb5dbbedffffff03dd81eb0000....]...........
0x584201500807d4d01750c8b74242883fe0189...}M.u..t$(....
0x584305d4e75318d45535053ffb52d0a00008d]Nu1.ESPS..-....
⋯10 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.