Suspicious 80% Download

Trojan-Dropper.Win32.VB.fpq

Named Trojan-Dropper, evasion strings

MZ DOS signature validation stringReferences the Windows debugger output API
SHA-256e2ed701719d9786c56038a533d18bf4fa0313f089fe09e0a16c8db392bae16c8
MaleculeO(Er)H(Po)

Evidence

References the Windows debugger output API 0x1a00–0x1ad0
⋯3 more rows
0x1a30b850104000ffd0ffe000000013000000.P.@............
0x1a404f75747075744465627567537472696eOutputDebugStrin
0x1a5067410000e4194000401a400000000400gA....@.@.@.....
0x1a60e04440000000000000000000a1e84440[email protected]@
⋯7 more rows
MZ DOS signature validation string 0x1bd0–0x1cf0
⋯5 more rows
0x1c2000000000c01a4000f84440002e000000[email protected]@.....
0x1c304d005a0020007300690067006e006100M.Z. .s.i.g.n.a.
0x1c40740075007200650020006e006f007400t.u.r.e. .n.o.t.
⋯11 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.