Hostile ^100% pe-machine-learning-dataset Download

32472

packed dropper with embedded PE

Parasitic entrypoint drops an embedded PEParasitic PE dropper entrypoint

SHA-256ba615a9da8f61d70c5cc5412df4d56ac25e7dc3b75d96223c51f1e6276c49fbe

MaleculeO₄(C₂IAs₃Er)H₆(Cm₃CrDbDsF₂Os₆)Md₃(Bi₇PaSi)

Evidence

English function-word token "this" 0x0–0xe0

0x04d5a90000300000004000000ffff0000MZ..............
0x10b8000000000000004000000000000000........@.......
0x2000000000000000000000000000000000................
0x3000000000000000000000000010010000................
0x400e1fba0e00b409cd21b8014ccd215468........!..L.!Th
0x5069732070726f6772616d2063616e6e6fis program canno
⋯9 more rows

Multiplicative hash inner loop 0x93354–0x93424

⋯3 more rows
0x93384984b008bc2c1e8078bc869c01b010000.K........i.....
0x9339469c90000001b8bdac1e31933cb8bdac1i..........3....
0x933a4e3080bdac1e3080bcb8d1c1233c333c2............3.3.
0x933b40bc133d233db0bd10bc38914f520414f..3.3........ AO
⋯7 more rows

Dynamic library loading via LoadLibraryA 0xabfd0–0xac0f0

⋯3 more rows
0xac000a6730d00be730d005c490d00564a0d00.s...s..\I..VJ..
0xac010404a0d002a4a0d00184a0d00044a0d00@J..*J...J...J..
0xac020f6490d00dc490d00cc490d00ba490d00.I...I...I...I..
0xac030ac490d009e490d0090490d0084490d00.I...I...I...I..
0xac04074490d006a480d0040490d002e490d00[email protected]..
0xac05022490d0016490d0006490d00f0480d00"I...I...I...H..
0xac060da480d00ce480d00be480d00ae480d00.H...H...H...H..
0xac0709c480d008a480d0080480d0000000000.H...H...H......
0xac0807314008022140080ef04008073050080s...".......s...
⋯7 more rows

References C fopen file-open API 0xac4d0–0xac6e0

⋯8 more rows
0xac55058470d0030470d0026470d0014470d00XG..0G..&G...G..
0xac560f8460d00dc460d00cc460d00c2460d00.F...F...F...F..
0xac570ba460d00b0460d00a6460d009c460d00.F...F...F...F..
0xac58094460d008c460d0082460d007a460d00.F...F...F..zF..
0xac59072460d0068460d005c460d0050460d00rF..hF..\F..PF..
0xac5a046460d002a460d0020460d0014460d00FF..*F.. F...F..
⋯4 more rows
0xac5f044450d0028450d0020450d0018450d00DE..(E.. E...E..
0xac60010450d0006450d00fe440d00f4440d00.E...E...D...D..
0xac610ec440d00e0440d00d8440d00ce440d00.D...D...D...D..
0xac620c4440d00ae440d0092440d007a440d00.D...D...D..zD..
⋯3 more rows
0xac6601e4b0d00304b0d00b64a0d00c64a0d00.K..0K...J...J..
0xac670a64a0d009a4a0d00ee4a0d007e4a0d00.J...J...J..~J..
0xac6808e4a0d00000000008c2f0d00882d0d00.J......./...-..
⋯6 more rows

Resolves temp-file write and execution APIs 0xf6fa0–0xf7290

⋯5 more rows
0xf6ff000000000000000000000000000000000................
0xf7000558bec81ec6c01000033c05356578945U....l...3.SVW.E
0xf7010dc8945f08945ec8945f88945f48945e0..E..E..E..E..E.
0xf70208945e8c745b86e506345c745bc506f2e.E..E.nPcE.E.Po.
0xf703065c745c078650000c745c400000000e8e.E.xe...E......
0xf7040000000005805250200008945fc64a130....X.%....E.d.0
0xf70500000008945d88b45fcc70083c404e98b....E..E........
0xf706045fcc740044dc4f9ff8b45d88b400c8b[email protected]..@..
0xf7070401c8b008b40088b483c8b4c017803c8@[email protected]<.L.x..
⋯8 more rows
0xf71003332c745a02e646c6cffd6e967ffffff32.E..dll...g...
0xf711081f957696e457511817a047865630075..WinEu..z.xec.u
0xf7120088975f4e99200000081f9436c6f7375..u........Closu
0xf713017817a046548616e750e817a08646c65..z.eHanu..z.dle
0xf71400075058975f8eb7381f9577269747517.u..u..s..Writu.
0xf7150817a046546696c750e0fb74a0883f965.z.eFilu...J...e
0xf716075058975eceb548b0a81f94372656175u..u..T....Creau
0xf717017817a0474654669750e817a086c6541..z.teFiu..z.leA
0xf71800075058975f0eb3381f9476574547517.u..u..3..GetTu.
0xf7190817a04656d7050750e817a0861746841.z.empPu..z.athA
⋯8 more rows
0xf7220ffff50ff55f08bf083feff74388b45fc..P.U......t8.E.
0xf723033c981384d5a9000740c404181f9f4013..8MZ..t.@A....
0xf724000007ceeeb0f578d4dd45168003e0000..|...W.M.Qh.>..
0xf72505056ff55ec56ff55f86a058d8594feffPV.U.V.U.j......
0xf7260ff50ff55f45f5e5bc9c300ce32ce32ec.P.U._^[....2.2.
0xf7270034d5a90000300000004000000ffff00.MZ.............
0xf728000b80000000000000040000000000000.........@......
0xf729000000000000000000000000000000000................