Benign Download

Backdoor.Win32.Pahador.c

Image list icon size importExecute shell command (ShellExecuteA)

SHA-25639771ff57e65a58df2dbe183e0e3bfd78f1fb73aaf5abb151d8a492bcb0c609f

Evidence

Query/set system parameters (string) 0x7acf2–0x7ad92

0x7acf26765000000005472616e736c6174654dge....TranslateM
0x7ad024449537973416363656c000000005472DISysAccel....Tr
0x7ad1261636b506f7075704d656e7500000000ackPopupMenu....
0x7ad2253797374656d506172616d6574657273SystemParameters
0x7ad32496e666f41000000537761704d6f7573InfoA...SwapMous
0x7ad4265427574746f6e00000053686f775769eButton...ShowWi
⋯5 more rows

Query/set system parameters (symbol) 0x7d49c–0x7d58c

0x7d49c2c374c37543758375c37603764376837,7L7T7X7\7`7d7h7
0x7d4ac6c377037743778377c37803784378837l7p7t7x7|7.7.7.7
0x7d4bc8c3790379437a837c837d037d437d837.7.7.7.7.7.7.7.7
0x7d4ccdc37e037e437e837ec37f037f437f837.7.7.7.7.7.7.7.7
0x7d4dcfc370038043808380c38d838dc38e038.7.8.8.8.8.8.8.8
⋯11 more rows

Execute shell command (ShellExecuteA) 0x7d684–0x7d854

⋯14 more rows
0x7d764333c403c4d3c5f3c643c7f3c8c3c993c3<@<M<_<d<.<.<.<
0x7d774ab3cb03cce3cdb3cea3cfc3c013d203d.<.<.<.<.<.<.= =
0x7d7842d3d383d453d573d5c3d743d943d9c3d-=8=E=W=\=t=.=.=
0x7d794a03da43da83dac3db03db43db83dbc3d.=.=.=.=.=.=.=.=
0x7d7a4143e203e3f3e4e3e8b3e903ebb3eca3e.> >?>N>.>.>.>.>
0x7d7b4073f0c3fb23fbc3fc63fcf3fdf3fee3f.?.?.?.?.?.?.?.?
0x7d7c4f83f000000400100900000000d301630[email protected]
0x7d7d42630493054307b30a030b030cf30ff30&0I0T0{0.0.0.0.0
0x7d7e42a31e631f431593285329232a632ad32*1.1.1Y2.2.2.2.2
⋯7 more rows