Benign Download

Trojan.Win32.Sadenav.hv

Embedded PE binary at file offset 0x96ee8 (~69632 bytes)Image list icon size import

SHA-256034d034c1d1498a6e31f8015737863a534241919bb602f99fee481b5c28e45cc

Evidence

Query/set system parameters (string) 0x8afc4–0x8b064

0x8afc46765000000005472616e736c6174654dge....TranslateM
0x8afd44449537973416363656c000000005472DISysAccel....Tr
0x8afe461636b506f7075704d656e7500000000ackPopupMenu....
0x8aff453797374656d506172616d6574657273SystemParameters
0x8b004496e666f4100000053686f7757696e64InfoA...ShowWind
0x8b0146f770000000053686f775363726f6c6cow....ShowScroll
⋯5 more rows

Query/set system parameters (symbol) 0x8d53c–0x8d62c

0x8d53cbe32d732ef326e33723376337a337e33.2.2.2n3r3v3z3~3
0x8d54c823386338a338e33923396339a339e33.3.3.3.3.3.3.3.3
0x8d55ca233a633aa33ae33b233b633ba33be33.3.3.3.3.3.3.3.3
0x8d56cc233d1330e34233438344d3430353435.3.3.4#484M40545
0x8d57c38353c354035443548354c355035543585<5@5D5H5L5P5T5
⋯11 more rows

Execute shell command (ShellExecuteA) 0x8d720–0x8d920

⋯17 more rows
0x8d830f935fd350136053609360d3611361536.5.5.6.6.6.6.6.6
0x8d840e9377d389638c1381b397539d339223a.7}8.8.8.9u9.9":
0x8d8506d3a7b3a733d9a3dcd3de63dfd3d253fm:{:s=.=.=.=.=%?
0x8d860004001001c01000010312f3147315f31[email protected]/1G1_1
0x8d870ce31e531f8310a3288329d32b232b732.1.1.1.2.2.2.2.2
0x8d880c432e432fe320333d533363443345e34.2.2.2.3.364C4^4
0x8d890643478347d345d3582358f359a35bb35d4x4}4]5.5.5.5.5
0x8d8a0d135e935ee35233632363f364a365d36.5.5.5#626?6J6]6
0x8d8b06a36b236b736d136ff360b3717372137j6.6.6.6.6.7.7!7
⋯7 more rows

Embedded PE binary at file offset 0x96ee8 (~69632 bytes) 0x96ea8–0x96f78

⋯3 more rows
0x96ed84d00410049004e00490043004f004e00M.A.I.N.I.C.O.N.
0x96ee84d5a50000200000004000f00ffff0000MZP.............
0x96ef8b80000000000000040001a0000000000........@.......
0x96f0800000000000000000000000000000000................
⋯7 more rows