Hostile ^92% datasets Download

c3dc71edc05a9e1778bbea6757b65c1f9b2f491615cb68ba686eedafb3afc0f5.exe

Legitimate Microsoft HelpLibManager.exe

autogenerated rule brought to you by yara-signatorAuthenticode chain CN: Microsoft Corporation

SHA-256c3dc71edc05a9e1778bbea6757b65c1f9b2f491615cb68ba686eedafb3afc0f5

MaleculeO(Pr)H₅(Db₂FOs₂Po₂U)Md₃(Bi₂PaSi₄)Th

Evidence

SW_HIDE window flag reference 0x1964a–0x1970a

⋯3 more rows
0x1967a65787457726974657200577269746500extWriter.Write.
0x1968a53575f484944450053575f53484f574eSW_HIDE.SW_SHOWN
0x1969a4f524d414c0053575f53484f574d494eORMAL.SW_SHOWMIN
⋯7 more rows

Multiple .NET reflection resolver APIs 0x1b9b2–0x1bae2

⋯5 more rows
0x1ba0274616e6365006765745f44656661756ctance.get_Defaul
0x1ba12740044656661756c740053797374656dt.Default.System
0x1ba222e5265666c656374696f6e0050726f70.Reflection.Prop
0x1ba3265727479496e666f0047657450726f70ertyInfo.GetProp
0x1ba426572747956616c75650053657450726fertyValue.SetPro
0x1ba52706572747956616c7565004372656174pertyValue.Creat
0x1ba626544656c6567617465004576656e7449eDelegate.EventI
0x1ba726e666f004164644576656e7448616e64nfo.AddEventHand
⋯7 more rows

IsUserAnAdmin API call 0x1c35b–0x1c41b

⋯3 more rows
0x1c38b6c657465005541435574696c69747900lete.UACUtility.
0x1c39b497355736572416e41646d696e00456dIsUserAnAdmin.Em
0x1c3ab707479006765745f4c656e6774680046pty.get_Length.F
⋯7 more rows

References the .NET System.Linq namespace 0x1c465–0x1c555

⋯3 more rows
0x1c4956172730053797374656d2e436f726500ars.System.Core.
0x1c4a553797374656d2e4c696e7100456e756dSystem.Linq.Enum
0x1c4b5657261626c6500436f6e7461696e7300erable.Contains.
⋯10 more rows

autogenerated rule brought to you by yara-signator 0x2a533–0x2a783

⋯8 more rows
0x2a5b33ecf9ef11b06c6e1e38001e3b1051883>...............
0x2a5c30d88a01c51ab25b53ae778f3bd95ab4e....Q.%.:.x....N
0x2a5d3d8fbfd7162ddabd01292ba856bdd4fdd...qb.......k.O.
0x2a5e3aa3ab5cf3efb9cb3d75abf95f6810e75.:..>....Z.....u
0x2a5f3a8431dea50873ad4a10e75a8431dea50.C..P.:...u.C..P
0x2a603873ad4a10e75a8431dea50873ad4a10e.:...u.C..P.:...
0x2a61375a8431dea50873ad4a10e75a8431deau.C..P.:...u.C..
⋯4 more rows
0x2a6631dea50873ad4a10e75a8432f3089f33d..P.:...u.C/0..=
0x2a67380f348e21c3e3f19e973f8dca10ebd24..H..>?..s.....$
0x2a683e8252b0026cb9e0018e93175f43dfafc.%+.&.....1u.=..
0x2a6932424d6ac5e635ef78aeb07b75eb465e0$$..^c^.....^.e.
⋯15 more rows