Benign Download

Trojan-Clicker.Win32.Delf.afj

CreateRemoteThread API referenceCreateRemoteThread API string
SHA-2563244a72ff58274c9d624bdc8dbde43f33447cf789b545c62306cfe8eb34f5462
MaleculeO(P)H(Po)

Evidence

CreateRemoteThread API string 0x1b036–0x1b106
⋯3 more rows
0x1b06669746963616c53656374696f6e000000iticalSection...
0x1b07643726561746552656d6f746554687265CreateRemoteThre
0x1b08661640000000043726561746550726f63ad....CreateProc
0x1b09665737341000000004372656174655069essA....CreatePi
⋯7 more rows
CreateRemoteThread API reference 0x1d2d0–0x1d3a0
⋯3 more rows
0x1d300343a383a3c3a403a443a483a4c3a503a4:8:<:@:D:H:L:P:
0x1d310543a583a5c3a000000f0010014000000T:X:\:..........
0x1d3200030043008300c300000000000000000.0.0.0.0........
0x1d33000000000000000000000000000000000................
⋯7 more rows
Embedded PE binary at file offset 0x1d6dc (~761856 bytes) 0x1d69c–0x1d76c
⋯3 more rows
0x1d6cc41004700450049004e0046004f000000A.G.E.I.N.F.O...
0x1d6dc4d5a50000200000004000f00ffff0000MZP.............
0x1d6ecb80000000000000040001a0000000000........@.......
0x1d6fc00000000000000000000000000000000................
⋯7 more rows
Query/set system parameters (string) 0xbfe8a–0xbff2a
0xbfe8a6765000000005472616e736c6174654dge....TranslateM
0xbfe9a4449537973416363656c000000005472DISysAccel....Tr
0xbfeaa61636b506f7075704d656e7500000000ackPopupMenu....
0xbfeba53797374656d506172616d6574657273SystemParameters
0xbfeca496e666f4100000053686f7757696e64InfoA...ShowWind
0xbfeda6f770000000053686f775363726f6c6cow....ShowScroll
⋯5 more rows
Windows Time Provider persistence 0x156212–0x1562e2
⋯3 more rows
0x156242757272656e74436f6e74726f6c536574urrentControlSet
0x1562525c53657276696365735c77333274696d\Services\w32tim
0x156262655c54696d6550726f7669646572735ce\TimeProviders\
0x1562724e7470436c69656e745d0d0a22456e61NtpClient].."Ena
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.