Suspicious ^80% pe-machine-learning-dataset Download

512265

Packed, unsigned, remote process injection

Binary contains high-entropy data regionsPE has RT_BITMAP in resources list

SHA-256cc79082a92729cd222e51a0f8ccb55bfb53e90127d5047fb42d9df9971387452

MaleculeO₃(As₃C₂Er₂)H₉(Cm₃Db₂FHfMgOs₄PoTiU)Md₃(Bi₅Si)

Evidence

Small code section in large PE 0x3c0–0x650

⋯3 more rows
0x3f000000000000000000000000000000000................
0x4000000000017075f5c0000000002000000......_\........
0x41038000000342a0000341e0000000000008...4*..4.......
0x42017075f5c000000000c00000014000000.._\............
⋯35 more rows

x86 indirect call through a global pointer 0x31fc–0x32bc

⋯3 more rows
0x322c8db42454010000897304c703e76f3400..$T....s....o4.
0x323c8b3520924600898424c0000000898c24.5 .F...$......$
0x324cbc00000089bc24b8000000ffd683ec08......$.........
⋯7 more rows

Inline PE signature validation constant 0x86ec–0x87ac

⋯3 more rows
0x871c89e556508b450831c98b503c89c601d6..VP.E.1..P<....
0x872c813c10504500000f44ce89c883c4045e.<.PE...D......^
0x873c5dc35589e553575683e4f881ec000100].U..SWV........
⋯7 more rows

x86 e_lfanew to PE signature walk 0x89bf–0x8a7f

⋯3 more rows
0x89ef242380c3c2889c24e30000008b4c244c$#.....$.....L$L
0x89ff03483c894c24388b4424388b4c242421.H<.L$8.D$8.L$$!
0x8a0fc9898c24e40000008138504500000f85...$.....8PE....
⋯7 more rows

Packed loader largest section ratio above 0.65 0xa5c0–0xa870

⋯3 more rows
0xa5f000000000000000000000000000000000................
0xa600b74690fd40ecf9a7c6f3d235069016e1[email protected]....
0xa61020a291a919d2dd8d731921531d29e9e4 .......s.!S.)..
0xa620d6be53bbdee5a650789e20f8513ab6ef..S....Px. .Q:..
0xa630cfc74753f7997265e6c41789ee5071fa..GS..re.....Pq.
0xa64046da75f0fe3409d855352e7b4fc83bb7F.u..4..U5.{O.;.
0xa650ccb8262c018ffaf90d978e6ced679883..&,.......l.g..
0xa6604cbf186603197418d582ccbbb74690fdL..f..t......F..
0xa67040ecf9a7c6f3d235069016e120a291a9@......5.... ...
0xa68019d2dd8d731921531d29e9e4d6be53bb....s.!S.)....S.
0xa690dee5a650789e20f8513ab6efcfc74753...Px. .Q:....GS
0xa6a0f7997265e6c41789ee5071fa46da75f0..re.....Pq.F.u.
0xa6b0fe3409d855352e7b4fc83bb7ccb8262c.4..U5.{O.;...&,
0xa6c0018ffaf90d978e6ced6798834cbf1866.......l.g..L..f
0xa6d003197418d582ccbbb74690fd40ecf9a7..t......F..@...
0xa6e0c6f3d235069016e120a291a919d2dd8d...5.... .......
0xa6f0731921531d29e9e4d6be53bbdee5a650s.!S.)....S....P
0xa700789e20f8513ab6efcfc74753f7997265x. .Q:....GS..re
0xa710e6c41789ee5071fa46da75f0fe3409d8.....Pq.F.u..4..
0xa72055352e7b4fc83bb7ccb8262c018ffaf9U5.{O.;...&,....
0xa7300d978e6ced6798834cbf186603197418...l.g..L..f..t.
0xa740d582ccbbb74690fd40ecf9a7c6f3d235[email protected]
0xa750069016e120a291a919d2dd8d73192153.... .......s.!S
0xa7601d29e9e4d6be53bbdee5a650789e20f8.)....S....Px. .
0xa770513ab6efcfc74753f7997265e6c41789Q:....GS..re....
0xa780ee5071fa46da75f0fe3409d855352e7b.Pq.F.u..4..U5.{
0xa7904fc83bb7ccb8262c018ffaf90d978e6cO.;...&,.......l
0xa7a0ed6798834cbf186603197418d582ccbb.g..L..f..t.....
0xa7b0b74690fd40ecf9a7c6f3d235069016e1[email protected]....
0xa7c020a291a919d2dd8d731921531d29e9e4 .......s.!S.)..
0xa7d0d6be53bbdee5a650789e20f8513ab6ef..S....Px. .Q:..
0xa7e0cfc74753f7997265e6c41789ee5071fa..GS..re.....Pq.
0xa7f046da75f0fe3409d855352e7b4fc83bb7F.u..4..U5.{O.;.
0xa800ccb8262c018ffaf90d978e6ced679883..&,.......l.g..
0xa8104cbf186603197418d582ccbbb74690fdL..f..t......F..
0xa82040ecf9a7c6f3d235069016e120a291a9@......5.... ...
0xa83019d2dd8d731921531d29e9e4d6be53bb....s.!S.)....S.
0xa840dee5a650789e20f8513ab6efcfc74753...Px. .Q:....GS
0xa850f7997265e6c41789ee5071fa46da75f0..re.....Pq.F.u.
0xa860fe3409d855352e7b4fc83bb7ccb8262c.4..U5.{O.;...&,
0xa870018ffaf90d978e6ced6798834cbf1866.......l.g..L..f