SourTrade Browser-Assembled PE: .bun Section + JSC Bytecode + High-Entropy Padding

Duo Tech@duotech

•updated Jul 27, 2026•0•0•1

Detects PE files identified as SourTrade payloads by identifying the presence of a '.bun' section, an embedded 'app.js' string indicative of JavaScriptCore usage, and a high-entropy data block within the '.bun' section, distinguishing malicious payloads from legitimate Bun-compiled binaries.