Benign Download

Backdoor.Win32.Agent.dol

Image list icon size importExecute shell command (ShellExecuteA)
SHA-25605189974fb93063454eb69ef6094653eac3990ca6a0c07aaf20ed1e4bc6a58e4
MaleculeH₂(PoU)

Evidence

Query/set system parameters (string) 0x62532–0x625d2
0x62532654d65737361676500005472616e736ceMessage..Transl
0x625426174654d4449537973416363656c0000ateMDISysAccel..
0x62552547261636b506f7075704d656e750000TrackPopupMenu..
0x6256253797374656d506172616d6574657273SystemParameters
0x62572496e666f4100000053686f7757696e64InfoA...ShowWind
0x625826f77000053686f775363726f6c6c4261ow..ShowScrollBa
⋯5 more rows
Query/set system parameters (symbol) 0x64478–0x64638
0x6447800000000000000000000000000000000................
0x6448800000000000000000000000000000000................
0x6449800000000000000000000000000000000................
0x644a800000000000000000000000000000000................
0x644b800000000000000000000000000000000................
⋯24 more rows
Execute shell command (ShellExecuteA) 0x6464c–0x6480c
⋯12 more rows
0x6470c00000000000000000000000000000000................
0x6471c00000000000000000000000000000000................
0x6472c00000000000000000000000000000000................
0x6473c00000000000000000000000000000000................
0x6474c00000000000000000000000000000000................
0x6475c00000000000000000000000000000000................
0x6476c00000000000000000000000000000000................
0x6477c00000000000000000000000000000000................
0x6478c00000000000000000000000000000000................
0x6479c00000000000000000000000000000000................
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.