Benign Download

Backdoor.Win32.SdBot.iem

Image list icon size importExecute shell command (ShellExecuteA)

SHA-2561d4a7bb0b1867aaccbf5d19725cbc9a0839c9a476cb65aea7b8deae89b6f98f2

Evidence

Query/set system parameters (string) 0x54a56–0x54af6

0x54a566765000000005472616e736c6174654dge....TranslateM
0x54a664449537973416363656c000000005472DISysAccel....Tr
0x54a7661636b506f7075704d656e7500000000ackPopupMenu....
0x54a8653797374656d506172616d6574657273SystemParameters
0x54a96496e666f4100000053686f7757696e64InfoA...ShowWind
0x54aa66f770000000053686f775363726f6c6cow....ShowScroll
⋯5 more rows

Query/set system parameters (symbol) 0x5a798–0x5a878

0x5a7985030543058305c306030643068306c30P0T0X0\0`0d0h0l0
0x5a7a87030743078307c308030843088308c30p0t0x0|0.0.0.0.0
0x5a7b89030943098309c30a030a430a830ac30.0.0.0.0.0.0.0.0
0x5a7c8b030bc30c730cb30d930e130fa300231.0.0.0.0.0.0.0.1
0x5a7d8063122312a3142314a3167316f319131.1"1*1B1J1g1o1.1
⋯10 more rows

Execute shell command (ShellExecuteA) 0x5abfc–0x5ad0c

⋯3 more rows
0x5ac2c38315831b6331c34293572359035c13581X1.3.4)5r5.5.5
0x5ac3c19369c36a536b23646384a384e385238.6.6.6.6F8J8N8R8
0x5ac4c56385a385e38c0381f3a983bae3be43bV8Z8^8.8.:.;.;.;
0x5ac5cfa3b263c5f3c6a3c803c913ca33cad3c.;&<_<j<.<.<.<.<
0x5ac6cc33cd43cb23d083e833e823f913fa83f.<.<.=.>.>.?.?.?
0x5ac7cbc3fdd3fec3f000000a0040090000000.?.?.?..........
0x5ac8c73319b31b331db3122331d344e346634s1.1.1.1"3.4N4f4
0x5ac9c87349234ab34c934e53408352a355635.4.4.4.4.4.5*5V5
⋯7 more rows