Benign Download

Net-Worm.Win32.Kolab.agd

High-entropy UPX1 packed payload sectionIsDebuggerPresent API name in PE strings
SHA-256c29a8465003831efca3a4eca91f8cb304a0428bc4a2cfa85680d8c5881f50b96
MaleculeH(Po₂)Md(Bi)

Evidence

High-entropy UPX1 packed payload section 0x1c0–0x290
⋯3 more rows
0x1f000000000000000000000000000000000................
0x200db34ffff04104000010843617264696e[email protected]
0x210616c0500ff901c176cb7dfbe0a065374al......l.....St
0x220721667ff259c700d8bc0079832c82083r.g.%.p.....2. .
⋯7 more rows
IsDebuggerPresent API name in PE strings 0x558ad–0x5597d
⋯3 more rows
0x558dd6f6465202564290025583a4441460000ode %d).%X:DAF..
0x558ed4973446562756767657250726573656eIsDebuggerPresen
0x558fd740000004b65726e656c333200000000t...Kernel32....
0x5590d284c6f636174696f6e205845422c2065(Location XEB, e
⋯7 more rows
References the Windows debugger output API 0x55b75–0x55c55
⋯3 more rows
0x55ba56d000000777269746520746f00000000m...write to....
0x55bb54f75747075744465627567537472696eOutputDebugStrin
0x55bc5675700004f7574707574446562756753gW..OutputDebugS
0x55bd57472696e674100005f52530025750000tringA.._RS.%u..
0x55be553657450726f6365737353687574646fSetProcessShutdo
⋯7 more rows
Query/set system parameters (string) 0x332b7b–0x332c1b
0x332b7b46696e6457696e646f775700e6014d65FindWindowW...Me
0x332b8b7373616765426f785700ae0044726177ssageBoxW...Draw
0x332b9b416e696d617465645265637473009a02AnimatedRects...
0x332bab53797374656d506172616d6574657273SystemParameters
0x332bbb496e666f57002d0252656d6f76655072InfoW.-.RemovePr
0x332bcb6f7057004b0147657450726f70570000opW.K.GetPropW..
⋯5 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.