Benign Download

Trojan-GameThief.Win32.Nilage.ahi

Detects an XORed URL in an executableEncoded content decoded: xor
SHA-256cbc4df08813440a6ef5b10307aca5710c7c9f64c71008e8a4fdf039a85b2faa4
MaleculeMdTh

Evidence

Detects an XORed URL in an executable 0x6a34–0x6af4
⋯3 more rows
0x6a64ffc3e92dbdffffebeb8be55dc3000000...-.......]....
0x6a74e8f4f4f0baafafb5b8aeb2b1b5aeb6b5................
0x6a84aeb3b3aff8e9e1efe8e1e9aff8f8aee5................
⋯7 more rows
Encoded content decoded: xor 0x13688–0x13768
⋯3 more rows
0x136b88a3e00c04fc9e26effffffff37000000.>..O..n....7...
0x136c8e8f4f4f0f3baafaff2f5eef5f0aee3ef................
0x136d8edaef4f7afede5ede2e5f2dfe1e3e3ef................
0x136e8f5eef4dff0e1f3f3f7eff2e4dfedefe4................
0x136f8e9e6f9aef0e8f00025442c33cb26d011........%D,3.&..
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.