Suspicious ^80% Download

2026-10-02_1176876d79c18816193e6926f47efb09_elex_emotet_icedid

Emotet/IcedID malware sample

Call to GetDriveTypeA by raw bytesModern PE without ASLR enabled

SHA-256dcd8cbcd13d12a241b937a0dfd140f062d7a328b285a8fbe3a69deb70eb60ffa

URLhttps://tria.ge/api/v0/samples/261003-vsqefaty5q/sample

MaleculeO₆(AlAs₆CCoDyEr)H₉(CmDb₂F₈Hf₃MgOs₈PoTiU₂)Md₅(Bi₈HePaSi)

Evidence

Indirect call followed by a compare branch 0x162b–0x16eb

⋯3 more rows
0x165b40010000c20400568d4c2404515033f6@......V.L$.QP3.
0x166bff1528e3430083f8ff7413f644240410..(.C....t..D$..
0x167b7405be0100000050ff152ce343008bc6t......P..,.C...
⋯7 more rows

x86 indirect call through a global pointer 0x8cd6–0x8d96

⋯3 more rows
0x8d06ff15e4e243008bf83bfb0f8487000000....C...;.......
0x8d168b3510e3430068e4f5430057ffd63bc3.5..C.h..C.W..;.
0x8d26a3f01b4500747068d0f5430057ffd63b...E.tph..C.W..;
⋯7 more rows

Reads the 32-bit Windows TEB self pointer 0x1744d–0x1751d

⋯3 more rows
0x1747d83ec2053568b75088b5e08f6c303751b.. SV.u..^....u.
0x1748d64a1180000008945088b45088b48083bd......E..E..H.;
0x1749dd9894dfc720c3b5804730733c0e9f001..M.r.;X.s.3....
0x174ad0000578b7e0c83ffff750833c040e9de..W.~....u.3.@..
⋯7 more rows

Native stack immediate byte-string fragment 0x1d7f2–0x1d8e2

⋯3 more rows
0x1d822ff7f000081e10080000023c66685c957..........#.f..W
0x1d832c645e4ccc645e5ccc645e6ccc645e7cc.E...E...E...E..
0x1d842c645e8ccc645e9ccc645eaccc645ebcc.E...E...E...E..
0x1d852c645ecccc645edccc645eefbc645ef3f.E...E...E...E.?
0x1d862c745d4010000008bd07406c643022deb.E.......t..C.-.
0x1d87204c64302206685d28b7d0c750d85ff75..C. f...}.u...u
⋯7 more rows

GUI import cluster BeginPaint 0x3dfc8–0x3e2b8

⋯3 more rows
0x3dff8000000000000000068d5040098d40400........h.......
0x3e008a8d40400b6d40400cad40400dad40400................
0x3e018ead40400f8d404000ad504001cd50400................
0x3e0282ed5040040d504008ad4040054d50400[email protected]...
0x3e03800000000e2d5040011000080fad50400................
0x3e0480ed6040022d6040034d6040000000000...."...4.......
0x3e05842d3040054d3040068d304002cd30400B...T...h...,...
0x3e0688cd304009ad30400a8d30400b6d30400................
⋯10 more rows
0x3e118aad004009cd004008cd004007ed00400............~...
0x3e12800000000f4c3040000c4040012c40400................
0x3e13822c4040032c4040042c4040054c40400"...2...B...T...
0x3e14866c4040074c4040088c4040094c40400f...t...........
0x3e158b2c40400c0c40400cec40400dcc40400................
0x3e168ecc40400fcc4040018c5040032c50400............2...
0x3e1784ac50400e8c304007ec5040090c50400J.......~.......
0x3e1889ec50400b8c50400cec50400e8c50400................
0x3e198f8c5040008c604001ac604002cc60400............,...
0x3e1a846c6040056c6040066c6040076c60400F...V...f...v...
0x3e1b8dcc30400ccc30400bcc30400a2c30400................
0x3e1c888c3040074c3040066c304004ec30400....t...f...N...
0x3e1d83cc304002ec304001ec3040010c30400<...............
0x3e1e804c30400f0c20400dec20400d2c20400................
0x3e1f8c6c20400b8c20400acc2040094c20400................
0x3e2087cc2040064c2040058c204004cc20400|...d...X...L...
0x3e21834c2040026c204001cc204000cc204004...&...........
0x3e228fec10400f2c10400e4c10400ccc10400................
0x3e238bcc10400acc1040094c1040086c10400................
0x3e2486ec1040052c1040040c104002cc10400n...R...@...,...
0x3e25818c1040004c10400f6c00400e8c00400................
0x3e268d2c00400b6c0040098c0040080c00400................
0x3e27872c004005ec0040048c0040030c00400r...^...H...0...
0x3e28816c004000ac00400febf0400e6bf0400................
0x3e298d6bf0400c8bf0400bebf0400b0bf0400................
0x3e2a8a2bf040092bf040080bf040074bf0400............t...
0x3e2b864bf04004ebf040038bf040026bf0400d...N...8...&...