Benign Download

Backdoor.Win32.Poison.bd

Detects an XORed URL in an executableEncoded content decoded: xor
SHA-256e70cda2164ea1b49d45e13317cb5b6fc05dccf48d35dbb253fece313371e504b
MaleculeMdTh

Evidence

Encoded content decoded: xor 0x2a10–0x2af0
⋯3 more rows
0x2a4082283836278c31f519803974f519a8a8.(86'.1...9t....
0x2a506c50514b18484a575f4a595518554d4blPQK.HJW_JYU.UMK
0x2a604c185a5d184a4d56184d565c5d4a186fL.Z].JMV.MV\]J.o
0x2a7051560b0a35321c0f3838383838383838QV..52..88888888
0x2a80383838383838383838383838383838388888888888888888
⋯7 more rows
Encoded content decoded: xor → base64 0x7cb8–0x7d88
⋯3 more rows
0x7ce8535d4a565d540b0a165c545438383838S]JV]T...\TT8888
0x7cf87b4a5d594c5d6c575754505d54480b0a{J]YL]lWWTP]TH..
0x7d086b5659484b50574c38383838705d5948kVYHKPWL8888p]YH
0x7d180b0a74514b4c7e514a4b4c38705d5948..tQKL~QJKL8p]YH
⋯7 more rows
Detects an XORed URL in an executable 0x1368c–0x1374c
⋯3 more rows
0x136bcd363b3dd65fb3838c7c7c7c710383838.c..e.88.....888
0x136cc504c4c484b021717565d404d4b164859PLLHK...V]@MK.HY
0x136dc4b4b48574a4c165b5755174a5c4a1748KKHWJL.[WU.J\J.H
⋯7 more rows
Query/set system parameters (string) 0x1b43a–0x1b4da
0x1b43a415a5c675d4e5d564c3838386d485c59AZ\g]N]VL888mH\Y
0x1b44a4c5d6f51565c574f383838386c4a5956L]oQV\WO8888lJYV
0x1b45a4b54594c5d755d4b4b595f5d38383838KTYL]u]KKY_]8888
0x1b46a6b414b4c5d5568594a59555d4c5d4a4bkAKL]UhYJYU]L]JK
0x1b47a71565e57793838386b4f594875574d4bqV^Wy888kOYHuWMK
0x1b48a5d7a4d4c4c57563838386b50574f6f51]zMLLWV888kPWOoQ
⋯5 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.