Suspicious 86% Download

devfreq_wq.elf

Packed, stripped, high entropy

Hostile sectionless MIPS UPX profileBinary contains a UPX packing marker
SHA-256fc5b9e6337bbb8ff175b9258c8812efc9f6e35ea0fa1bbe13d18bbe3ccc6cc0e
URLhttps://tria.ge/api/v0/samples/261004-e6mygavxfz/sample
MaleculeO(As₂)Md₃(Bi₄BkHe)

Evidence

ELF64 header omits section table 0x0–0x1f0
0x07f454c46020201000000000000000000.ELF............
0x10000200150000000100000000007b5230.............{R0
0x2000000000000000400000000000000000.......@........
0x3000000001004000380003000000000000[email protected]........
0x4000000001000000060000000000000000................
0x5000000000000100000000000000010000................
⋯7 more rows
0xd000000000000000000000000000000000................
0xe000000000000000081f9081cf55505821............UPX!
0xf018ec0e8c00000000005d0094002b48d8.........]...+H.
0x10000000158000000680e0000001a03003f...X...h.......?
⋯15 more rows
Canonical trailing UPX PackHeader magic 0x196c38–0x196c98
⋯3 more rows
0x196c6872ebf800000000005550582100000000r.......UPX!....
0x196c78555058210e8c0e07005d009400196c78UPX!.....]....lx
0x196c88014c627282706158005d0094d000004d.Lbr.paX.].....M
0x196c98000000f4 ....

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.