AI
Concealed PE payload with anti-debugging
Local reference
Suspicious dependency
Inferred
Mal-ecule
O₃(As₂ErPr)H₅(Db₄FMg₂Os₇Po₇)Md(Bi₃)
Unsigned PE combines anti-debugging, thread hijacking, and executable memory: libwinpthread-1.dll:0x1041a8
Concealed PE payload paired with executable-memory modification: libwinpthread-1.dll:0x0
Low entropy overlay inflation: libwinpthread-1.dll:0x0
| 0x0 | 4d5a90000300000004000000ffff0000 | MZ..............Concealed PE payload paired with executable-memory modification |
| 0x10 | b8000000000000004000000000000000 | ........@....... |
| 0x20 | 00000000000000000000000000000000 | ................ |
| 0x30 | 00000000000000000000000080000000 | ................ |
| 0x40 | 0e1fba0e00b409cd21b8014ccd215468 | ........!..L.!Th |
| 0x50 | 69732070726f6772616d2063616e6e6f | is program canno |
| 0x60 | 742062652072756e20696e20444f5320 | t be run in DOS |
| 0x70 | 6d6f64652e0d0d0a2400000000000000 | mode....$....... |
| 0x80 | 5045000064860600f7245b6a00000000 | PE..d....$[j.... |
| 0x90 | 00000000f00022200b02023200261000 | ......" ...2.&.. |
| 0xa0 | 00a01c000000000064eb0f0000100000 | ........d....... |
| 0xb0 | 00000080010000000010000000020000 | ................ |
| 0xc0 | 06000000000000000600000000000000 | ................ |
| 0xd0 | 000032000004000089022d0002006001 | ..2.......-...`. |
| 0xe0 | 00001000000000000010000000000000 | ................ |
| 0xf0 | 00001000000000000010000000000000 | ................ |
| 0x100 | 0000000010000000f0962b0061220000 | ..........+.a".. |
| 0x110 | 54b92b00dc00 | T.+... |
| 0x5ff9d | bf24040085db0f84d3010000488b9da8 | .$..........H... |
| 0x5ffad | 000000448b7308443bf67441488d4b2c | ...D.s.D;.tAH.K, |
| 0x5ffbd | e89ec3faff488bc8488b554841b80500 | .....H..H.UHA... |
| 0x5ffcd | 0000e82cbcfaff85c074224489742420 | ...,.....t"D.t$ |
| 0x5ffdd | 498bcc488b95c00000004c8b85b80000 | I..H......L..... |
| 0x5ffed | 004c8bcfe82a02000085c07542488b8d | .L...*.....uBH.. |
| 0x5fffd | b000000048894d08488bd34889551048 | ....H.M.H..H.U.H |
| 0x6000d | 8d4d58e8fb230400488b4d08488b5510 | .MX..#..H.M.H.U. |
| 0x6001d | 41ffd5448bf0488d4d58e83424040045 | A..D..H.MX.4$..EConcealed PE payload paired with executable-memory modification |
| 0x6002d | 85f60f8574ffffff33dbe95e01000048 | ....t...3..^...H |
| 0x6003d | 8b9d10010000488b5b10488d0d1a8228 | ......H.[.H....( |
| 0x6004d | 00488379f8000f8527010000488b0d78 | .H.y....'...H..x |
| 0x6005d | c92500488b4908ba000100003909e8f0 | .%.H.I......9... |
| 0x6006d | 5c01004885c0750633c933d2eb07488d | \..H..u.3.3...H. |
| 0x6007d | 48108b50084533c04c89858000000048 | H..P.E3.L......H |
| 0x6008d | 89858800000044898590000000c68594 | ......D......... |
| 0x6009d | 0000000048898d980000008995a00000 | ....H........... |
| 0x600ad | 00488d0d23802800488379f8000f85ca | .H..#.(.H.y..... |
| 0x600bd | 000000488b0d21c72500488b7108488d | ...H..!.%.H.q.H. |
| 0x600cd | 0d966c2700e8792efbff488bc8e821f2 | ..l'..y...H...!. |
| 0x600dd | ffff488bd0488bce3909e8b439ffff48 | ..H..H..9...9..H |
| 0x600ed | 8bf08b8d900000003b8da00000000f87 | ........;....... |
| 0x600fd | 93000000488b95980000008bc1488d04 | ....H........H.. |
| 0x6010d | 428b95a00000002bd13956087611488d | B......+.9V.v.H. |
| 0x6011d | 8d80000000488bd6 | .....H.. |
| 0xfe243 | 01776ae88d06000085c0742885db7524 | .wj.......t(..u$ |
| 0xfe253 | 488d0d66b01c00e85639000085c07510 | H..f....V9....u. |
| 0xfe263 | 488d0d6eb01c00e84639000085c0742e | H..n....F9....t. |
| 0xfe273 | 32c0eb33660f6f05718219004883c8ff | 2..3f.o.q...H... |
| 0xfe283 | f30f7f0535b01c004889053eb01c00f3 | ....5...H..>.... |
| 0xfe293 | 0f7f053eb01c0048890547b01c00c605 | ...>...H..G..... |
| 0xfe2a3 | 11b01c0001b0014883c4205bc3b90500 | .......H.. [.... |
| 0xfe2b3 | 0000e852050000cccc4883ec184c8bc1 | ...R.....H...L.. |
| 0xfe2c3 | b84d5a00006639053111f0ff75784863 | .MZ..f9.1...uxHcConcealed PE payload paired with executable-memory modification |
| 0xfe2d3 | 0d6411f0ff488d152111f0ff4803ca81 | .d...H..!...H... |
| 0xfe2e3 | 3950450000755fb80b02000066394118 | 9PE..u_.....f9A. |
| 0xfe2f3 | 75544c2bc20fb751144883c2184803d1 | uTL+...Q.H...H.. |
| 0xfe303 | 0fb74106488d0c804c8d0cca48891424 | ..A.H...L...H..$ |
| 0xfe313 | 493bd174188b4a0c4c3bc1720a8b4208 | I;.t..J.L;.r..B. |
| 0xfe323 | 03c14c3bc072084883c228ebdf33d248 | ..L;.r.H..(..3.H |
| 0xfe333 | 85d2750432c0eb14837a24007d0432c0 | ..u.2....z$.}.2. |
| 0xfe343 | eb0ab001eb0632c0eb0232c04883c418 | ......2...2.H... |
| 0xfe353 | c340534883ec208ad9e87705000033d2 | .@SH.. ...w...3. |
| 0xfe363 | 85c0740b84db75074887153eaf1c0048 | ..t...u.H..>...H |
| 0xfe373 | 83c4205bc340534883ec20803d33af1c | .. [.@SH.. .=3.. |
| 0xfe383 | 00008ad9740484d2750ce8ce9afaff8a | ....t...u....... |
| 0xfe393 | cbe89f110000b0014883c4205bc3cccc | ........H.. [... |
| 0xfe3a3 | cc40534883ec2048833d0eaf1c00ff48 | .@SH.. H.=.....H |
| 0xfe3b3 | 8bd97507e80b380000eb0f488bd3488d | ..u...8....H..H. |
| 0xfe3c3 | 0df8ae1c00e8ee37000033d285c0 | .......7..3... |
| 0x103fd0 | 30323030303030303234303030303532 | 0200000024000052 |
| 0x103fe0 | 35333431333130303034303030303031 | 5341310004000001 |
| 0x103ff0 | 30303031303034623836633463623738 | 0001004b86c4cb78 |
| 0x104000 | 35343962333462616236316133623138 | 549b34bab61a3b18 |
| 0x104010 | 30306532336266656235623365633339 | 00e23bfeb5b3ec39 |
| 0x104020 | 30303734303431353336613765336362 | 0074041536a7e3cb |
| 0x104030 | 64393766356630346366306638353731 | d97f5f04cf0f8571 |
| 0x104040 | 35356138393238656161323965626664 | 55a8928eaa29ebfd |
| 0x104050 | 31316366626261643362613730656665 | 11cfbbad3ba70efe |
| 0x104060 | 61376264613332323663366138643337 | a7bda3226c6a8d37 |
| 0x104070 | 30613463643330336637313434383662 | 0a4cd303f714486b |
| 0x104080 | 36656263323235393835613633383437 | 6ebc225985a63847 |
| 0x104090 | 31653665663537316363393261343631 | 1e6ef571cc92a461 |
| 0x1040a0 | 33633030623866613635643631636365 | 3c00b8fa65d61cce |
| 0x1040b0 | 65306362653566333633333063396130 | e0cbe5f36330c9a0 |
| 0x1040c0 | 31663431383335353966316265663234 | 1f4183559f1bef24 |
| 0x1040d0 | 63633239313763366439313365336135 | cc2917c6d913e3a5 |
| 0x1040e0 | 34313333336131643035643962656432 | 41333a1d05d9bed2 |
| 0x1040f0 | 326233386362a50253696e676c652070 | 2b38cb..Single p |
| 0x104100 | 726f64756365722073696e676c652063 | roducer single c |
| 0x104110 | 6f6e73756d6572206279746520627566 | onsumer byte buf |
| 0x104120 | 666572206d616e6167656d656e742e0d | fer management.. |
| 0x104130 | 0a0d0a436f6d6d6f6e6c792055736564 | ...Commonly Used |
| 0x104140 | 2054797065733a0d0a53797374656d2e | Types:..System. |
| 0x104150 | 494f2e506970656c696e65732e506970 | IO.Pipelines.Pip |
| 0x104160 | 650d0a53797374656d2e494f2e506970 | e..System.IO.Pip |
| 0x104170 | 656c696e65732e506970655772697465 | elines.PipeWrite |
| 0x104180 | 720d0a53797374656d2e494f2e506970 | r..System.IO.Pip |
| 0x104190 | 656c696e65732e506970655265616465 | elines.PipeReade |
| 0x1041a0 | 727bd1505d5702b9a308d9a4f1a409a5 | r{.P]W..........Unsigned PE combines anti-debugging, thread hijacking, and executable memory |
| 0x1041b0 | 21a50439a5a5a57b11545d57000002d5 | !..9...{.T]W.... |
| 0x1041c0 | a57b1154b99e00000405a635a6030880 | .{.T.......5.... |
| 0x1041d0 | d351b1e12b65a6000000000000000002 | .Q..+e.......... |
| 0x1041e0 | b5a60002d5a67bc157b99e000002f9a6 | ......{.W....... |
| 0x1041f0 | 7b215b5d5700000235a77b215bb99e00 | {![]W...5.{![... |
| 0x104200 | 000665a795a7c5a70b0c80d349ac252f | ..e.........I.%/ |
| 0x104210 | f5a7000000021da80000000000000001 | ................ |
| 0x104220 | 04d349ac252fc9560000000000000000 | ..I.%/.V........ |
| 0x104230 | 0000007b495e7da8000002f9a8124d69 | ...{I^}.......Mi |
| 0x104240 | 63726f736f66747b316095a904ada961 | crosoft{1`.....aConcealed PE payload paired with executable-memory modification |
| 0x104250 | aa0002d5aa19620005ab1dab0245ab00 | ......b......E.. |
| 0x104260 | 000b0080d3f1ae61ab71ac0000000002 | .......a.q...... |
| 0x104270 | 5547000000000002f1ac19620005ab19 | UG.........b.... |
| 0x104280 | ad0000000b0880d3f1ae61ab35ad0000 | ..........a.5... |
| 0x104290 | 000004e947adad0002e9ad0000000219 | ....G........... |
| 0x1042a0 | ae2c577261704e6f6e45786365707469 | .,WrapNonExcepti |
| 0x1042b0 | 6f6e5468726f77734b0881d351b1c536 | onThrowsK...Q..6 |
| 0x1042c0 | 59ae00000000000000000004d3f9b4e7 | Y............... |
| 0x134bc0 | 73d91a5b69bc1b69db69a531829677d2 | s..[i..i.i.1..w. |
| 0x134bd0 | 82a77d449be6dbf71f4a55c3b1535d4a | ..}D.....JU..S]J |
| 0x134be0 | 3df02e1f3eea3ce74bedcab47b6fce98 | =...>.<.K...{o.. |
| 0x134bf0 | 0dcc425b3b38ef490a2be034e602c372 | ..B[;8.I.+.4...r |
| 0x134c00 | 150e827cf6452bf24ecb11be41d1bcb7 | ...|.E+.N...A...Concealed PE payload paired with executable-memory modification |
| 0x134c10 | 99b8079db7b402209b7b33631d408d5a | ....... .{3c.@.Z |
| 0x134c20 | c4030b69b567c88dce4c0148c5bcf6e1 | ...i.g...L.H.... |
| 0x134c30 | 886956c28e94b6cc24f7fa3bbaf208a2 | .iV.....$..;.... |
| 0x134c40 | 9811c863041aa29a52d65b8cb9f0bd9e | ...c....R.[..... |
| 0x134c50 | 1ab6ad2d2279900be4a4a37b785549f5 | ...-"y.....{xUI. |
| 0x134c60 | a779f6fcc4c1517968046be5fc4f46d7 | .y....Qyh.k..OF. |
| 0x134c70 | a0d2383afc8f52479ca4474bd69b9674 | ..8:..RG..GK...t |
| 0x134c80 | a3c7444a8ec988868dd47509342338c4 | ..DJ......u.4#8. |
| 0x134c90 | de4ed6e57a544d51d648a7dec3bccdcf | .N..zTMQ.H...... |
| 0x134ca0 | 229ff95b64e16ee8705896f0abd9b18f | "..[d.n.pX...... |
| 0x134cb0 | c526ad2db772193f5ffb2b82be6114f5 | .&.-.r.?_.+..a.. |
| 0x134cc0 | 52073618c741de85960f9392d3324ba0 | R.6..A.......2K. |
| 0x134cd0 | bc62b50312554bae0c1ff7d560652c2f | .b...UK.....`e,/ |
| 0x134ce0 | ab2aa9dd95c7bbeb04e63f6d40a14ba9 | .*........?m@.K. |
| 0x134cf0 | c93dac4f13642f4e840d7168bb289c6c | .=.O.d/N..qh.(.l |
| 0x134d00 | f8dfc0b5a7ddd31fa7711bc54eeb616a | .........q..N.aj |
| 0x134d10 | 717f7449b337a756c61d700b81f07ba2 | q.tI.7.V..p...{. |
| 0x134d20 | e33766cbfc3f71995eaf96318543d2f9 | .7f..?q.^..1.C.. |
| 0x134d30 | 58cd19f84348366c4474069e4007b9bf | X...CH6lDt..@... |
| 0x134d40 | 1551411ddb0e190041c72471613e5c88 | .QA.....A.$qa>\. |
| 0x134d50 | a849008fe3c568e020354882414e6ef7 | .I....h. 5H.ANn. |
| 0x134d60 | 1c1c62f02be3a2c0f868a9047d4deb85 | ..b.+....h..}M.. |
| 0x134d70 | 2157328d00103710255340e999a9e86f | !W2...7.%S@....o |
| 0x134d80 | 0b255dc9f282dd7894aced0dc29c11fc | .%]....x........ |
| 0x134d90 | 649d453baf3c8b2c85142360869781fb | d.E;.<.,..#`.... |
| 0x134da0 | 3c0ef70733671b11fe2a3be197c19dfc | <...3g...*;..... |
| 0x134db0 | cfc7e8684be122f710a7ceaab934717b | ...hK."......4q{ |
| 0x134dc0 | d66c429c6b4b01e54b5554566606ff7a | .lB.kK..KUTVf..z |
| 0x134dd0 | 688eb5bb6d58cca360c35835832ff4e4 | h...mX..`.X5./.. |
| 0x134de0 | 0b8303386a5b3ca1bf9ac82c2c835dc1 | ...8j[<....,,.]. |
| 0x134df0 | 82ad0efcc71f358366bfde36c5b1e34e | ......5.f..6...N |
| 0x134e00 | 5d746b039bae2ae5252de214537b28e3 | ]tk...*.%-..S{(. |
| 0x134e10 | 914230bdcdd252d6c676cb0ec8555f94 | .B0...R..v...U_. |
| 0x134e20 | 86571313654e949a35bfee1c6749f94c | .W..eN..5...gI.L |
| 0x134e30 | 7394d52437817c7201503563cd9a1f9b | s..$7.|r.P5c.... |
| 0x134e40 | b436805a8f1cff83809ec9bf5dbf2adc | .6.Z........].*. |
| 0x134e50 | 3fda8f0cc1c3a456d8f787ebae9253bc | ?......V......S. |
| 0x134e60 | ee86df7a6ac9d618376329d117e43ad4 | ...zj...7c)...:. |
| 0x134e70 | 072730a78c40cd5e4338b204599ead95 | .'0..@.^C8..Y... |
Objectives
Micro-behaviors
Metadata
20 of 37 traits shown
Identity
| SHA-256 | 75a0d2b32af70bcbffb8ed27215b60c924efd460a85cd21013fc1b83e1d2fdc8 |
|---|---|
| Filename | libwinpthread-1.dll |
| Package | 75a0d2b32af70bcbffb8ed27215b60c924efd460a85cd21013fc1b83e1d2fdc8 |
| Version | 1 |
Origin
| Source | harvest |
|---|---|
| Feed | malwarebazaar |
| Ecosystem | windows |
| Domain | abuse.ch |
Timeline
| First seen | 21 Jul 2026 13:49 UTC |
|---|---|
| First analyzed | 22 Jul 2026 04:39 UTC |
| Last analyzed | 22 Jul 2026 04:39 UTC |
| Last updated | 22 Jul 2026 04:39 UTC |
Labeling
| Label | bad |
|---|---|
| Label source | harvest |
| Traits version | 89834 |
Not seeing what you expected? Let us know