I am trying to analyze a possible malicious sample. It's a windows executable
e3f04124e2e26f8f030f6845086875a9 Md5sum Intel 386 or later processors and compatible processors File 2464.exe 2464.exe: PE32 executable (console) Intel 80386, for MS Windows
It showed some data like
1. unusual section name ".leopard" 2. Raw size of ".bss" is zero 3. Found VM detection artifact "RDTSCP trick"
I am how having a unusual section name .leopard is a trouble and how .bss of size zero is a sign of
malicious activity. Also what is RDTSCP trick and are there any other ways I could analyze the