{"action":"created","issue":{"url":"https://api.github.com/repos/fireeye/flare-floss/issues/166","repository_url":"https://api.github.com/repos/fireeye/flare-floss","labels_url":"https://api.github.com/repos/fireeye/flare-floss/issues/166/labels{/name}","comments_url":"https://api.github.com/repos/fireeye/flare-floss/issues/166/comments","events_url":"https://api.github.com/repos/fireeye/flare-floss/issues/166/events","html_url":"https://github.com/fireeye/flare-floss/issues/166","id":154885123,"number":166,"title":"MemcpyHook.apicall failed - Killed","user":{"login":"mr-tz","id":17606537,"avatar_url":"https://avatars.githubusercontent.com/u/17606537?v=3","gravatar_id":"","url":"https://api.github.com/users/mr-tz","html_url":"https://github.com/mr-tz","followers_url":"https://api.github.com/users/mr-tz/followers","following_url":"https://api.github.com/users/mr-tz/following{/other_user}","gists_url":"https://api.github.com/users/mr-tz/gists{/gist_id}","starred_url":"https://api.github.com/users/mr-tz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mr-tz/subscriptions","organizations_url":"https://api.github.com/users/mr-tz/orgs","repos_url":"https://api.github.com/users/mr-tz/repos","events_url":"https://api.github.com/users/mr-tz/events{/privacy}","received_events_url":"https://api.github.com/users/mr-tz/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/fireeye/flare-floss/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-05-15T01:46:08Z","updated_at":"2016-06-20T22:10:37Z","closed_at":null,"body":"Sample: 558b...6fd0c\r\n```\r\n$ floss 558b...6fd0c -gv\r\nINFO:floss:Generating vivisect workspace\r\nINFO:floss:Identifying decoding functions...\r\nMost likely decoding functions in: 558b...6fd0c\r\naddress      score\r\n---------  -------\r\n0x4032E0   0.90303\r\n0x406780   0.71818\r\n0x404520   0.69091\r\n0x403DE0   0.54848\r\n0x4077D8   0.48333\r\n0x407B34   0.43939\r\n0x407943   0.42121\r\n0x4079B4   0.42121\r\n0x403D60   0.41061\r\n0x403170   0.40303\r\n\r\nINFO:floss:Decoding strings...\r\nWARNING:Monitor:logAnomaly: anomaly: MemcpyHook.apicall failed: \r\nKilled\r\n```"},"comment":{"url":"https://api.github.com/repos/fireeye/flare-floss/issues/comments/227285424","html_url":"https://github.com/fireeye/flare-floss/issues/166#issuecomment-227285424","issue_url":"https://api.github.com/repos/fireeye/flare-floss/issues/166","id":227285424,"user":{"login":"williballenthin","id":156560,"avatar_url":"https://avatars.githubusercontent.com/u/156560?v=3","gravatar_id":"","url":"https://api.github.com/users/williballenthin","html_url":"https://github.com/williballenthin","followers_url":"https://api.github.com/users/williballenthin/followers","following_url":"https://api.github.com/users/williballenthin/following{/other_user}","gists_url":"https://api.github.com/users/williballenthin/gists{/gist_id}","starred_url":"https://api.github.com/users/williballenthin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/williballenthin/subscriptions","organizations_url":"https://api.github.com/users/williballenthin/orgs","repos_url":"https://api.github.com/users/williballenthin/repos","events_url":"https://api.github.com/users/williballenthin/events{/privacy}","received_events_url":"https://api.github.com/users/williballenthin/received_events","type":"User","site_admin":false},"created_at":"2016-06-20T22:10:37Z","updated_at":"2016-06-20T22:10:37Z","body":"looks like memcpy tries to move a huge amount of data:\r\n\r\n`argv: [1701116920, 4278124286, 4227595256]`"}}
{"actor":{"display_login":"williballenthin"}}