Benign Download

Backdoor.Win32.GWGirl.15

Image list icon size importExecute shell command (ShellExecuteA)
SHA-2560338a72a927eae758a193d4ca4ee8cae9efb6f1c34d37dbb7a3f28e581158219
MaleculeH₂(PoU)

Evidence

Query/set system parameters (string) 0x96caa–0x96d4a
0x96caa6765000000005472616e736c6174654dge....TranslateM
0x96cba4449537973416363656c000000005472DISysAccel....Tr
0x96cca61636b506f7075704d656e7500000000ackPopupMenu....
0x96cda53797374656d506172616d6574657273SystemParameters
0x96cea496e666f4100000053686f7757696e64InfoA...ShowWind
0x96cfa6f770000000053686f775363726f6c6cow....ShowScroll
⋯5 more rows
Query/set system parameters (symbol) 0x984a0–0x98590
0x984a0000000000000010000000000200b0000............ ...
0x984b000000000e1841f2b0000000000000100.......+........
0x984c000000000300b000000000000e1841f2b....0..........+
0x984d0000000000000010000000000400b0000............@...
0x984e000000000e1841f2b0000000000000100.......+........
⋯11 more rows
Execute shell command (ShellExecuteA) 0x985c4–0x98824
⋯22 more rows
0x98724d00100000000000000000000947c0a00.............|..
0x98734d00100000000000000000000647e0a00............d~..
0x98744d0010000000000000000000034800a00............4...
0x98754d0010000000000000000000004820a00................
0x98764d00100000000000000000000d4830a00................
0x98774d00100000000000000000000a4850a00................
0x98784d0010000000000000000000074870a00............t...
0x98794d0010000000000000000000044890a00............D...
0x987a4c00000000000000000000000048a0a00................
0x987b4e00000000000000000000000e48a0a00................
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.