← All detection heuristics · Shellcode
critical
SC_XOR_ENCODED
What it means
Windows DLL or API names found XOR-encoded with a single-byte key.
Why it fires
Shellcode frequently XOR-encodes strings like 'kernel32.dll' or 'LoadLibraryA' to evade signature-based detection. At runtime, the shellcode decodes them with the same key before calling the APIs. Finding known library or API names encoded under a single-byte XOR key is a high-signal indicator of obfuscated shellcode. The analyzer brute-forces all 255 possible single-byte keys against common Windows DLL and API names to detect this technique.
Other Shellcode heuristics
SC_STR_CREATEREMOTETHREAD SC_MSF_BIND SC_MSF_REVERSE SC_MSF_C2 SC_STR_URLDOWNLOAD SC_STR_WRITEPROCESSMEMORY SC_STR_CREATEPROCESS SC_EGG_HUNTER SC_STR_GETPROCADDRESS SC_HEAP_SPRAY SC_STR_LOADLIBRARY SC_API_HASH_RESOLVER SC_PEB_ACCESS_X64 SC_PEB_ACCESS SC_STR_POWERSHELL SC_STR_SHELLEXEC SC_STR_WINEXEC SC_STR_WSCRIPT SC_XOR_DECODER SC_XOR_DECODED_NETWORK_CONFIG SC_STR_BITSADMIN SC_STR_CERTUTIL SC_STR_CMD SC_STR_MSHTA