Suspicious ^80% pe-machine-learning-dataset Download

314994

Unsigned embedded PE, dynamic API resolution

Authenticode chain CN: Cloud InstallerCert chain has only 2 entries

SHA-256c47964ed97cca36ce3835bee27b8cfdaf223d35638c76a8bfcb24b0bf4f72c12

MaleculeO₄(AsCoDyPr)H₈(Cm₅CrDb₃HfMgOs₈Po₄U)Md₅(BiPaPtSi₄)

Evidence

Uses internet communication API imports 0x46fc0–0x472b0

⋯3 more rows
0x46ff02e00000072656765785f6572726f7228....regex_error(
0x470006572726f725f70617273652900000000error_parse)....
0x4701072656765785f6572726f72286572726fregex_error(erro
0x47020725f73796e7461782900000072656765r_syntax)...rege
0x47030785f6572726f7200d8ce4600d0ed4000x_error...F...@.
0x47040f4794200f479420038c64600d15d4200.yB..yB.8.F..]B.
0x4705000ee400010ee40002a00000043000000..@...@.*...C...
0x47060050000000d000000b700000011000000................
0x4707014000000130000006f00000026000000........o...&...
0x47080aa000000100000008e00000010000000................
0x47090520000000d000000f303000005000000R...............
0x470a0f403000005000000f503000005000000................
0x470b0100000000d0000003700000013000000........7.......
0x470c064090000100000009100000029000000d...........)...
0x470d00b01000016000000700000001c000000........p.......
0x470e050000000110000000200000002000000P...............
0x470f0270000001c0000000c0000000d000000'...............
0x471000f000000130000000100000028000000............(...
0x4711006000000160000007b00000016000000........{.......
0x471202100000027000000d400000027000000!...'.......'...
0x471308300000016000000e60300000d000000................
0x47140080000000c000000150000000b000000................
0x4715011000000120000006e00000005000000........n.......
0x471606109000010000000e303000069000000a...........i...
0x471700e0000000c0000000300000002000000................
0x471801e00000005000000d50400000b000000................
0x471901900000005000000200000000d000000........ .......
0x471a004000000180000001d00000005000000................
0x471b0130000000d0000001d2700000d000000.........'......
0x471c040270000640000004127000065000000@'..d...A'..e...
0x471d03f270000660000003527000067000000?'..f...5'..g...
0x471e01927000009000000452700006a000000.'......E'..j...
0x471f04d2700006b000000462700006c000000M'..k...F'..l...
0x47200372700006d0000001e2700000e0000007'..m....'......
0x47210512700006e0000003427000070000000Q'..n...4'..p...
0x4722014270000040000002627000016000000.'......&'......
0x4723048270000710000002827000018000000H'..q...('......
0x4724038270000730000004f270000260000008'..s...O'..&...
0x4725042270000740000004427000075000000B'..t...D'..u...
0x4726043270000760000004727000077000000C'..v...G'..w...
0x472703a2700007b000000492700007e000000:'..{...I'..~...
0x4728036270000800000003d270000820000006'......='......
0x472903b270000870000003927000088000000;'......9'......
0x472a04c2700008a000000332700008c000000L'......3'......
0x472b066000000208144006400000040814400f... [email protected].

ATL ForceRemove registry script directive 0x545e0–0x546b0

⋯3 more rows
0x546104400000042000000560061006c000000D...B...V.a.l...
0x5462046006f00720063006500520065006d00F.o.r.c.e.R.e.m.
0x546306f007600650000004e006f0052006500o.v.e...N.o.R.e.
0x546406d006f00760065000000000044006500m.o.v.e.....D.e.
⋯7 more rows

Windows uninstall registry key path string 0x57ea0–0x58010

0x57ea07b00650078004500760065006e007400{.e.x.E.v.e.n.t.
0x57eb07d000000690065007300000034002e00}...i.e.s...4...
0x57ec032002e0030002e0031003900000000002...0...1.9.....
0x57ed07b003200380065003500360063006600{.2.8.e.5.6.c.f.
0x57ee062002d0065003300300065002d003400b.-.e.3.0.e.-.4.
⋯4 more rows
0x57f3069006e007300740061006c006c000000i.n.s.t.a.l.l...
0x57f4053004f00460054005700410052004500S.O.F.T.W.A.R.E.
0x57f505c004d006900630072006f0073006f00\.M.i.c.r.o.s.o.
0x57f60660074005c00570069006e0064006f00f.t.\.W.i.n.d.o.
0x57f70770073005c0043007500720072006500w.s.\.C.u.r.r.e.
0x57f806e007400560065007200730069006f00n.t.V.e.r.s.i.o.
0x57f906e005c0055006e0069006e0073007400n.\.U.n.i.n.s.t.
0x57fa061006c006c005c007b00320038006500a.l.l.\.{.2.8.e.
⋯7 more rows

References the Windows ShellExecute runas verb 0x630dc–0x631ac

⋯3 more rows
0x6310c54007900700065004c00690062000000T.y.p.e.L.i.b...
0x6311c720075006e006100730000002f006300r.u.n.a.s.../.c.
0x6312c200046004f00520020002f004c002000 .F.O.R. ./.L. .
⋯8 more rows

Standalone chrome.exe process-name token 0x6339c–0x6346c

⋯3 more rows
0x633cc6d006500480054004d004c0000000000m.e.H.T.M.L.....
0x633dc6300680072006f006d0065002e006500c.h.r.o.m.e...e.
0x633ec78006500000000004600690072006500x.e.....F.i.r.e.
0x633fc66006f007800550052004c0000000000f.o.x.U.R.L.....
0x6340c660069007200650066006f0078002e00f.i.r.e.f.o.x...
0x6341c6500780065000000490045002e004800e.x.e...I.E...H.
⋯5 more rows