Suspicious 86% pe-machine-learning-dataset Download

332630

Unsigned NSIS, admin, obfuscation

NSIS runtime error URL in dataNSIS runtime error title in data
SHA-256d947e82317cd81d69f3591ce3ad05f3458b5a26c52d0a6440a33c2ed9709bb61
MaleculeO₂(As₂C₂)H₇(CmDsF₁₁Os₇Po₄TiU₂)Md₄(Bi₈BkSi)

Evidence

x86 indirect call through a global pointer 0x4f9–0x5b9
⋯3 more rows
0x529704000ff765857ff1554704000ff7514[email protected]@..u.
0x5398b355870400057ffd689450c8d45e468[email protected]
0x54920080000506aff688036420057ff1558 ...Pj.h.6B.W..X
⋯7 more rows
NSIS self-extracting installer 0x20c1–0x2191
⋯3 more rows
0x20f12900008b45d8a9f0ffffff7572817ddc)...E......ur.}.
0x2101efbeadde7569817de8496e7374756081....ui.}.Instu`.
0x21117de4736f66747557817de04e756c6c75}.softuW.}.Nullu
0x21214e0945088b45088b0d18b0400083e002N.E..E.....@....
⋯7 more rows
Indirect call followed by a compare branch 0x29ea–0x2aaa
⋯3 more rows
0x2a1abc91400050ff15f070400085c0751657[email protected]@...u.W
0x2a2aff157870400083f8ff7404a810750657[email protected]
0x2a3ae8d81e000057e88b1e00005055e89123.....W.....PU..#
⋯7 more rows
Close directory enumeration handle 0x64be–0x65ae
⋯3 more rows
0x64ee830044656c65746546696c654100d200..DeleteFileA...
0x64fe46696e64466972737446696c65410000FindFirstFileA..
0x650edc0046696e644e65787446696c654100..FindNextFileA.
0x651ece0046696e64436c6f7365001b035365..FindClose...Se
0x652e7446696c65506f696e7465720000b502tFilePointer....
⋯8 more rows
Modify file creation/access/write times 0x6636–0x66f6
⋯3 more rows
0x66663400436c6f736548616e646c65001f034.CloseHandle...
0x667653657446696c6554696d65003900436fSetFileTime.9.Co
0x66866d7061726546696c6554696d6500db02mpareFileTime...
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.