← All detection heuristics · Shellcode
high
SC_XOR_DECODED_NETWORK_CONFIG
What it means
A known shellcode XOR key decoded one or more network destinations.
Why it fires
After independently recovering a single-byte XOR key from an encoded Windows API or DLL name, the analyzer performs one bounded decode of the same payload. Absolute URLs are surfaced with their key and source offset; downloader and process-execution APIs raise the finding to high severity. The decoded configuration is also carved for authenticated analyst preview.
Other Shellcode heuristics
SC_STR_CREATEREMOTETHREAD SC_MSF_BIND SC_MSF_REVERSE SC_MSF_C2 SC_STR_URLDOWNLOAD SC_STR_WRITEPROCESSMEMORY SC_XOR_ENCODED SC_STR_CREATEPROCESS SC_EGG_HUNTER SC_STR_GETPROCADDRESS SC_HEAP_SPRAY SC_STR_LOADLIBRARY SC_API_HASH_RESOLVER SC_PEB_ACCESS_X64 SC_PEB_ACCESS SC_STR_POWERSHELL SC_STR_SHELLEXEC SC_STR_WINEXEC SC_STR_WSCRIPT SC_XOR_DECODER SC_STR_BITSADMIN SC_STR_CERTUTIL SC_STR_CMD SC_STR_MSHTA