Benign Download

Backdoor.Win32.Tonerok.d

Embedded PE binary at file offset 0xde2 (~24094 bytes)Detour-style InstallHook helper name
SHA-2562fab8f439dd311895d8c7c2d81af142bd78cd80327c553b2d31b326915fe2505
MaleculeO(Er)

Evidence

Embedded PE binary at file offset 0xde2 (~24094 bytes) 0xda2–0xe72
⋯3 more rows
0xdd25c696e697465732e696e690046524545\inites.ini.FREE
0xde24d5a90000300000004000000ffff0000MZ..............
0xdf2b8000000000000004000000000000000........@.......
0xe0200000000000000000000000000000000................
⋯7 more rows
Detour-style InstallHook helper name 0x3134–0x31f4
⋯3 more rows
0x316400009a370000d2370000000000000000...7...7........
0x3174496e7374616c6c486f6f6b000300556eInstallHook...Un
0x3184696e7374616c6c486f6f6b00776d7372installHook.wmsr
⋯7 more rows
Embedded PE binary at file offset 0xde2 (~24094 bytes) Backdoor.Win32.Tonerok.d · 0xda2–0xe72
⋯3 more rows
0xdd25c696e697465732e696e690046524545\inites.ini.FREE
0xde24d5a90000300000004000000ffff0000MZ..............
0xdf2b8000000000000004000000000000000........@.......
0xe0200000000000000000000000000000000................
⋯7 more rows
Detour-style InstallHook helper name Backdoor.Win32.Tonerok.d · 0x3134–0x31f4
⋯3 more rows
0x316400009a370000d2370000000000000000...7...7........
0x3174496e7374616c6c486f6f6b000300556eInstallHook...Un
0x3184696e7374616c6c486f6f6b00776d7372installHook.wmsr
⋯7 more rows
Detour-style InstallHook helper name embedded:pe@0x5c02 · 0x73c–0x7fc
⋯3 more rows
0x76c02000300776d73726f33322e646c6c00....wmsro32.dll.
0x77c496e7374616c6c486f6f6b004b657962InstallHook.Keyb
0x78c6f61726450726f63004d6f7573655072oardProc.MousePr
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.