Benign Download

Trojan-Clicker.Win32.Agent.jw

Detects an XORed URL in an executableEncoded content decoded: xor
SHA-256df7cea925e635cf09644459c3ee956c767f24751070b07f0d6503cf64d3272d2
MaleculeMdTh

Evidence

Encoded content decoded: xor 0x21d7–0x22e7
⋯3 more rows
0x2207722e65786500776e645f636c61737300r.exe.wnd_class.
0x2217687474703a2f2f7777772e706f726e6fhttp://www.porno
0x2227786d6167732e636f6d2f73657475702fxmags.com/setup/
0x2237626c6f776a6f622e64617400186b414bblowjob.dat..kAK
0x22474c5d551879545d4a4c191800186b414bL]U.yT]JL....kAK
0x22574c5d551879545d4a4c1918006b414b4cL]U.yT]JL...kAKL
0x22675d551850594b185c5d4c5d5b4c5d5c18]U.PYK.\]L][L]\.
0x22775918564d555a5d4a18575e18595b4c51Y.VMUZ]J.W^.Y[LQ
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.