Benign Download

Backdoor.Win32.Prorat.auj

Embedded PE binary at file offset 0x5acb8 (~164096 bytes)References the Windows debugger output API
SHA-2560afe9f3dcb32458724c3ec09ec820698d42f24e92e5c65139d638cda9094443a
MaleculeO(Er)H(Po)

Evidence

Embedded PE binary at file offset 0x5acb8 (~164096 bytes) 0x5ac78–0x5ad48
⋯3 more rows
0x5aca8706170692e646c6c0000000000000000papi.dll........
0x5acb84d5a90000300000004000000ffff0000MZ..............
0x5acc8b8000000000000004000000000000000........@.......
0x5acd800000000000000000000000000000000................
⋯7 more rows
References the Windows debugger output API 0x65f63–0x66033
⋯3 more rows
0x65f934973426164577269746550747200f501IsBadWritePtr...
0x65fa34f75747075744465627567537472696eOutputDebugStrin
0x65fb367410000ff026c737472636d70694100gA....lstrcmpiA.
0x65fc3c3025669727475616c50726f74656374..VirtualProtect
⋯7 more rows
Detour-style InstallHook helper name 0x663ac–0x6646c
⋯3 more rows
0x663dc4c4c2e646c6c00486f6f6b50726f6300LL.dll.HookProc.
0x663ec496e7374616c6c486f6f6b0052656d6fInstallHook.Remo
0x663fc7665486f6f6b00000000000000000000veHook..........
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.