Benign Download

Backdoor.Win32.Hupigon.fanc

Embedded PE binary at file offset 0x9cbdc (~62500 bytes)Image list icon size import

SHA-2560718897b38e0b413b21fbb32d8b9c22ea792769a50edeb325c4fb1bc98d222cd

Evidence

Embedded PE binary at file offset 0x9cbdc (~62500 bytes) 0x9cb9c–0x9cc6c

⋯3 more rows
0x9cbcc4479480058794800616978696172616eDyH.XyH.aixiaran
0x9cbdc4d5a90000300000004000000ffff0000MZ..............
0x9cbecb8000000000000004000000000000000........@.......
0x9cbfc00000000000000000000000000000000................
⋯7 more rows

Query/set system parameters (string) 0xa1dc2–0xa1e62

0xa1dc26765000000005472616e736c6174654dge....TranslateM
0xa1dd24449537973416363656c000000005472DISysAccel....Tr
0xa1de261636b506f7075704d656e7500000000ackPopupMenu....
0xa1df253797374656d506172616d6574657273SystemParameters
0xa1e02496e666f4100000053686f7757696e64InfoA...ShowWind
0xa1e126f770000000053686f775363726f6c6cow....ShowScroll
⋯5 more rows

Query/set system parameters (symbol) 0xa363c–0xa372c

0xa363ca8080000000000000000000000000000................
0xa364c3c608539000000000000010004080000<`.9............
0xa365c600400003c560b00a80e000000000000`...<V..........
0xa366c00000000000000003c60853900000000........<`.9....
0xa367c01000000280c00808804008000000000....(...........
⋯11 more rows

Execute shell command (ShellExecuteA) 0xa3830–0xa3a00

⋯13 more rows
0xa3900ec7b0b00d80300000000000000000000.{..............
0xa3910000000003c6085390000000000000100....<`.9........
0xa39200000000028070000c47f0b00bc010000....(...........
0xa39300000000000000000000000003c608539............<`.9
0xa394000000000000001000000000050070000............P...
0xa395080810b00dc0000000000000000000000................
0xa3960000000003c6085390000000000000100....<`.9........
0xa397000000000780700005c820b0030010000....x...\...0...
0xa39800000000000000000000000003c608539............<`.9
0xa3990000000000000010000000000a0070000................
⋯7 more rows