AI
Anti-analysis debugger detection and loader
Local reference
Suspicious dependency
Inferred
Mal-ecule
O₂(AlP)H₄(DbDsOs₃Po)Md(Bi₂)
Service loader gates exception handling on debugger: 9ea2f55c1c91d04820f5082cf113c73c6320b157baa98d69654117cfc8458296:0xea40
Unsigned service DLL reads and loads worker: 9ea2f55c1c91d04820f5082cf113c73c6320b157baa98d69654117cfc8458296:0xea40
| 0x0 | 4d5a90000300000004000000ffff0000 | MZ.............. |
| 0x10 | b8000000000000004000000000000000 | ........@....... |
| 0x20 | 00000000000000000000000000000000 | ................ |
| 0x30 | 00000000000000000000000008010000 | ................ |
| 0x40 | 0e1fba0e00b409cd21b8014ccd215468 | ........!..L.!Th |
| 0x50 | 69732070726f6772616d2063616e6e6f | is program canno |
| 0x60 | 742062652072756e20696e20444f5320 | t be run in DOS |
| 0x70 | 6d6f64652e0d0d0a2400000000000000 | mode....$....... |
| 0x80 | c0c4276f84a5493c84a5493c84a5493c | ..'o..I<..I<..I< |
| 0x90 | 3039b83c80a5493c3039ba3cf3a5493c | 09.<..I<09.<..I< |
| 0xa0 | 3039bb3c89a5493c31fb4a3d85a5493c | 09.<..I<1.J=..I< |
| 0xb0 | 13fb | .. |
| 0xe9c0 | 0001000048d1e0488b7c2440488bb424 | ....H..H.|$@H..$ |
| 0xe9d0 | f8000000488bc8f3a4488b4424404889 | ....H....H.D$@H. |
| 0xe9e0 | 8424a8000000488b8424f00000004889 | .$....H..$....H. |
| 0xe9f0 | 8424b0000000488b8424b00000004889 | .$....H..$....H. |
| 0xea00 | 44242833c06689442420488b44242848 | D$(3.f.D$ H.D$(H |
| 0xea10 | 8b4c245048894810488b442428488378 | .L$PH.H.H.D$(H.x |
| 0xea20 | 1808721c488b8424c000000048894424 | ..r.H..$....H.D$ |
| 0xea30 | 48488b442428488b004889442448eb0a | HH.D$(H..H.D$H.. |
| 0xea40 | 488b4424284889442448488b44244848 | H.D$(H.D$HH.D$HHService loader gates exception handling on debugger |
| 0xea50 | 8b4c24500fb754242066891448488b84 | .L$P..T$ f..HH.. |
| 0xea60 | 24f00000004881c4d80000005f5ec3cc | $....H......_^.. |
| 0xea70 | 4c894424188854241048894c24085657 | L.D$..T$.H.L$.VW |
| 0xea80 | 4881ec280100000fb684244801000085 | H..(......$H.... |
| 0xea90 | c07505e9c1010000488b842440010000 | .u......H..$@... |
| 0xeaa0 | 4889442448488b442448488944245048 | H.D$HH.D$HH.D$PH |
| 0xeab0 | 8b4424504883c0184889442458488b44 | .D$PH...H.D$XH.D |
| 0xeac0 | 2458488338100f828d010000488b8424 | $XH.8.......H..$ |
| 0xead0 | 400100004889442460488b4424604889 | @...H.D$`H.D$`H. |
| 0xeae0 | 442468488b4424684889442470488b44 | D$hH.D$hH.D$pH.D |
| 0xeaf0 | 2470488b004889442440488b84244001 | $pH..H.D$@H..$@. |
| 0xeb00 | 00004889442478488b44247848898424 | ..H.D$xH.D$xH..$ |
| 0xeb10 | 80000000488b84248000000048898424 | ....H..$....H..$ |
| 0xeb20 | 88000000488b84248800000048898424 | ....H..$....H..$ |
| 0xeb30 | 00010000488b84244001000048898424 | ....H..$@...H..$ |
| 0xeb40 | 90000000488b842490000000488984 | ....H..$....H.. |
| 0x23f80 | 206c656e677468206f72206469737461 | length or dista |
| 0x23f90 | 6e63652073796d626f6c730000000000 | nce symbols..... |
| 0x23fa0 | 696e76616c696420636f6465206c656e | invalid code len |
| 0x23fb0 | 67746873207365740000000000000000 | gths set........ |
| 0x23fc0 | 696e76616c696420626974206c656e67 | invalid bit leng |
| 0x23fd0 | 74682072657065617400000000000000 | th repeat....... |
| 0x23fe0 | 696e76616c696420636f6465202d2d20 | invalid code -- |
| 0x23ff0 | 6d697373696e6720656e642d6f662d62 | missing end-of-b |
| 0x24000 | 6c6f636b00000000696e76616c696420 | lock....invalid Service loader gates exception handling on debugger |
| 0x24010 | 6c69746572616c2f6c656e6774687320 | literal/lengths |
| 0x24020 | 7365740000000000696e76616c696420 | set.....invalid |
| 0x24030 | 64697374616e63657320736574000000 | distances set... |
| 0x24040 | 696e76616c6964206c69746572616c2f | invalid literal/ |
| 0x24050 | 6c656e67746820636f64650000000000 | length code..... |
| 0x24060 | 696e76616c69642064697374616e6365 | invalid distance |
| 0x24070 | 20636f6465000000696e76616c696420 | code...invalid Unsigned service DLL reads and loads worker |
| 0x24080 | 64697374616e636520746f6f20666172 | distance too farResolve exports with GetProcAddress |
| 0x24090 | 206261636b000000696e636f72726563 | back...incorrec |
| 0x240a0 | 74206461746120636865636b00000000 | t data check.... |
| 0x240b0 | 696e636f7272656374206c656e677468 | incorrect length |
| 0x240c0 | 20636865636b00000000000000000000 | check.......... |
| 0x240d0 | 206465666c61746520312e332e312043 | deflate 1.3.1 C |
| 0x240e0 | 6f7079726967687420313939352d3230 | opyright 1995-20 |
| 0x240f0 | 3234204a65616e2d6c6f757020476169 | 24 Jean-loup Gai |
| 0x24100 | 6c6c7920616e64204d61726b2041646c | lly and Mark Adl |
| 0x24110 | 65722000000000000000000000000000 | er ............. |
| 0x24120 | 0000000000000000504d018001000000 | ........PM...... |
| 0x24130 | 0400040008000400a051018001000000 | .........Q...... |
| 0x24140 | 0400050010000800a051018001000000 | .........Q...... |
| 0x24150 | 0400060020002000a051018001000000 | .... . ..Q...... |
| 0x24160 | 0400040010001000e055018001000000 | .........U...... |
| 0x24170 | 0800100020002000e055018001000000 | .... . ..U...... |
| 0x24180 | 0800100080008000e055018001000000 | .........U...... |
| 0x24190 | 0800200080000001e055018001000000 | .. ......U...... |
| 0x241a0 | 2000800002010004e055018001000000 | ........U...... |
| 0x241b0 | 2000020102010010e055018001000000 | ........U...... |
| 0x241c0 | 00000000963007772c610eeeba510999 | .....0.w,a...Q.. |
| 0x241d0 | 19c46d078ff46a7035a563e9a395649e | ..m...jp5.c...d. |
| 0x241e0 | 3288db0ea4b8dc791ee9d5e088d9d297 | 2......y........ |
| 0x241f0 | 2b4cb609bd7cb17e072db8e7911dbf90 | +L...|.~.-...... |
| 0x24200 | 6410b71df220b06a4871b9f3de41be84 | d.... .jHq...A.. |
| 0x24210 | 7dd4da1aebe4dd6d51b5d4f4c785d383 | }......mQ....... |
| 0x24220 | 56986c13c0a86b647af962fdecc9658a | V.l...kdz.b...e. |
| 0x24230 | 4f5c0114d96c0663633d0ffaf50d088d | O\...l.cc=...... |
| 0x24240 | c8206e3b5e10694ce44160d5727167a2 | . n;^.iL.A`.rqg. |
| 0x24250 | d1e4033c47d4044bfd850dd26bb50aa5 | ...<G..K....k... |
| 0x24260 | faa8b5356c98b242d6c9bbdb40f9bcac | ...5l..B....@... |
| 0x24270 | e36cd832755cdf45cf0dd6dc593dd1ab | .l.2u\.E....Y=.. |
| 0x28240 | e0e1e2e3e4e5e6e7e8e9eaebecedeeef | ................ |
| 0x28250 | f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff | ................ |
| 0x28260 | 000102030405060708090a0b0c0d0e0f | ................ |
| 0x28270 | 101112131415161718191a1b1c1d1e1f | ................ |
| 0x28280 | 202122232425262728292a2b2c2d2e2f | !"#$%&'()*+,-./ |
| 0x28290 | 303132333435363738393a3b3c3d3e3f | 0123456789:;<=>? |
| 0x282a0 | 406162636465666768696a6b6c6d6e6f | @abcdefghijklmno |
| 0x282b0 | 707172737475767778797a5b5c5d5e5f | pqrstuvwxyz[\]^_ |
| 0x282c0 | 606162636465666768696a6b6c6d6e6f | `abcdefghijklmno |
| 0x282d0 | 707172737475767778797a7b7c7d7e7f | pqrstuvwxyz{|}~. |
| 0x282e0 | 808182838485868788898a8b8c8d8e8f | ................ |
| 0x282f0 | 909192939495969798999a9b9c9d9e9f | ................ |
| 0x28300 | a0a1a2a3a4a5a6a7a8a9aaabacadaeaf | ................ |
| 0x28310 | b0b1b2b3b4b5b6b7b8b9babbbcbdbebf | ................ |
| 0x28320 | c0c1c2c3c4c5c6c7c8c9cacbcccdcecf | ................ |
| 0x28330 | d0d1d2d3d4d5d6d7d8d9dadbdcdddedf | ................ |
| 0x28340 | e0e1e2e3e4e5e6e7e8e9eaebecedeeef | ................ |
| 0x28350 | f0f1f2f3f4f5f6f7f8f9fafbfcfd | .............. |
| 0x2fd42 | 72656e7454687265616449640000dd02 | rentThreadId.... |
| 0x2fd52 | 47657453797374656d54696d65417346 | GetSystemTimeAsF |
| 0x2fd62 | 696c6554696d65005403496e69746961 | ileTime.T.Initia |
| 0x2fd72 | 6c697a65534c69737448656164006a03 | lizeSListHead.j. |
| 0x2fd82 | 4973446562756767657250726573656e | IsDebuggerPresen |
| 0x2fd92 | 7400c50247657453746172747570496e | t...GetStartupIn |
| 0x2fda2 | 666f57006d024765744d6f64756c6548 | foW.m.GetModuleH |
| 0x2fdb2 | 616e646c65570000b70452746c506354 | andleW....RtlPcT |
| 0x2fdc2 | 6f46696c65486561646572002501456e | oFileHeader.%.En |
| 0x2fdd2 | 636f6465506f696e7465720044045261 | codePointer.D.Ra |
| 0x2fde2 | 697365457863657074696f6e0000bb04 | iseException.... |
| 0x2fdf2 | 52746c556e77696e644578005803496e | RtlUnwindEx.X.In |
| 0x2fe02 | 7465726c6f636b6564466c757368534c | terlockedFlushSL |
| 0x2fe12 | 69 | i |
Objectives
Micro-behaviors
Metadata
20 of 21 traits shown
Identity
| SHA-256 | 9ea2f55c1c91d04820f5082cf113c73c6320b157baa98d69654117cfc8458296 |
|---|---|
| Filename | 9ea2f55c1c91d04820f5082cf113c73c6320b157baa98d69654117cfc8458296 |
| Package | 9ea2f55c1c91d04820f5082cf113c73c6320b157baa98d69654117cfc8458296 |
Origin
| Source | harvest |
|---|---|
| Feed | malshare |
| Domain | malshare.com |
Timeline
| First seen | 9 Aug 2026 03:41 UTC |
|---|---|
| First analyzed | 9 Aug 2026 08:48 UTC |
| Last analyzed | 10 Aug 2026 08:40 UTC |
| Last updated | 10 Aug 2026 08:40 UTC |
Labeling
| Label | bad |
|---|---|
| Label source | harvest |
| Traits version | 73866 |
Not seeing what you expected? Let us know