Suspicious 80% Download

Backdoor.Win32.Poison.swd

Named backdoor, anti-analysis APIs

PE could not be identified by filefactsIsDebuggerPresent API name in PE strings
SHA-256fa1e92f030e9b916df24ebecfe6e981612d3bf696fb910bdf7c0818475fe3230
MaleculeO(Al)H(Po₂)

Evidence

PE could not be identified by filefacts 0x0–0xe0
0x04d5a90000300000004000000ffff0000MZ..............
0x10b8000000000000000100000000000000................
0x2000000000000000000000000000000000................
0x30000000000000000000000000b8000000................
⋯11 more rows
References the Windows debugger output API 0x3c28–0x3cf8
⋯3 more rows
0x3c58b8c0101001ffd0ffe000000013000000................
0x3c684f75747075744465627567537472696eOutputDebugStrin
0x3c786741000080381001683c100100000400gA...8..h<......
0x3c8830d511010000000000000000a138d5110............8..
⋯7 more rows
IsDebuggerPresent API name in PE strings 0x54a0–0x5570
⋯3 more rows
0x54d0fb272654ca91fb47888bf154a120a284.'&T...G...T. ..
0x54e04973646562756767657250726573656eIsdebuggerPresen
0x54f07400000080381001c054100100000400t....8...T......
0x550020d811010000000000000000a128d811 ............(..
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.