Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_24_1.vir

SUSPICIOUS

Mal-ecule

Size 325.6 KB download

First seen 56 days ago

Analyzed 44 days ago

Ecosystem datamaliciousorder

Objectives

command-and-control/channel XOR-encrypted UDP broadcast peer chat

anti-static/obfuscation WININET.DLL absent from PE import table

evasion/indicator-removal Export timestamp is absent

command-and-control/dropper/staging Binary contains high-entropy data regions

communications/socket UDP broadcast peer-to-peer communication

crypto/symmetric/xor XOR message encryption .NET method

data/db LINQ query operations

data/embedded/payload .NET resource bitmap pixel readback

data/encode/image Pixel operation symbols family A

binary PE binary has trailing overlay data

binary/metrics High code section entropy

build PE manifest version != VERSIONINFO product version

signed Binary is not digitally signed

binary/anomaly PE compile timestamp far in future

binary/section PE .reloc section presence

dotnet .NET assembly detected via BSJB CLR metadata signature

dylib::mscoree links mscoree.dll (CorExeMain)

hardening DEP / NX enabled (NX_COMPAT)

lang/compiler mscorlib reference

package PE InternalName metadata field

20 of 42 traits shown

SHA-256	b271f15120e69ae544c096b528961dcb21eb06dab1044973bce2628b2b9e2eaa
Filename	Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_24_1.vir

Not seeing what you expected? Let us know