Benign Download

Trojan-GameThief.Win32.Lmir.ame

Embedded PE binary at file offset 0xf060 (~31648 bytes)Detour-style InstallHook helper name
SHA-256bb29ead71cb30c6eb2310d27b1b4ea4abff437960d7d6eccd11b1fa893d26d86
MaleculeO(Er)

Evidence

Detour-style InstallHook helper name 0xbe48–0xbf08
⋯3 more rows
0xbe78e83b86ffffb3018bc35f5e5b5dc20400.;......._^[]...
0xbe88496e7374616c6c486f6f6b00535183e8InstallHook.SQ..
0xbe98010f82f00000007413480f8413010000.......t.H......
⋯7 more rows
Embedded PE binary at file offset 0xf060 (~31648 bytes) 0xf020–0xf0f0
⋯3 more rows
0xf0504b0041004700450049004e0046004f00K.A.G.E.I.N.F.O.
0xf0604d5a50000200000004000f00ffff0000MZP.............
0xf070b80000000000000040001a0000000000........@.......
0xf08000000000000000000000000000000000................
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.