Benign Download

Backdoor.Win32.Hupigon.dzur

Embedded PE binary at file offset 0x9cdb4 (~65536 bytes)Image list icon size import

SHA-25610b8b1ea264b9d49faecdf0de9b883288f80fe4e1819b3c32ac1d524203ca8e5

Evidence

Embedded PE binary at file offset 0x9cdb4 (~65536 bytes) 0x9cd74–0x9ce44

⋯3 more rows
0x9cda4f0774800347848005078480000000000.wH.4xH.PxH.....
0x9cdb44d5a90000300000004000000ffff0000MZ..............
0x9cdc4b8000000000000004000000000000000........@.......
0x9cdd400000000000000000000000000000000................
⋯7 more rows

Query/set system parameters (string) 0xa45ea–0xa468a

0xa45ea6765000000005472616e736c6174654dge....TranslateM
0xa45fa4449537973416363656c000000005472DISysAccel....Tr
0xa460a61636b506f7075704d656e7500000000ackPopupMenu....
0xa461a53797374656d506172616d6574657273SystemParameters
0xa462a496e666f4100000053686f7757696e64InfoA...ShowWind
0xa463a6f770000000053686f775363726f6c6cow....ShowScroll
⋯5 more rows

Query/set system parameters (symbol) 0xa6644–0xa6734

0xa664400000000000200000000000000000000................
0xa6654000000000000000000000000ffffff00................
0xa666400000000000000000000000000000000................
0xa667400000000000000000000000000000000................
0xa668400000000000000000000000000fe0000................
⋯11 more rows

Execute shell command (ShellExecuteA) 0xa6838–0xa6a08

⋯13 more rows
0xa690805bd800005bc0000037c000043000000.........|..C...
0xa691866000000760000007e0000007fc00000f...v...~.......
0xa69287f8000007f0000007e0000007c000000........~...|...
0xa693878000000700000006000000040000000x...p...`...@...
0xa694800000000ffffffffffffffffffc007ff................
0xa6958ffc007fffe0007fffe0007fff00007ff................
0xa6968f00007fff00007fff00007fff00007ff................
0xa6978f00007fff00007fff00007fff00007ff................
0xa6988f0003fff70003fff3001ffff1001ffff..?.p.?.0.......
0xa699800ffffff00ffffff000fffff001fffff................
⋯7 more rows