Suspicious 80% Download

Backdoor.Win32.TMS

Named backdoor, packed, network imports

Binary contains a UPX packing markerUPX decompression I/O error
SHA-2563d995f3bd811778eed292a7d650f258159c7e458765f34df70c82576b2a5e9f8
MaleculeH₂(CmOs)

Evidence

Enumerate network resource entries import 0x3e328–0x3e4f8
⋯3 more rows
0x3e358423505004e3505006035050000000000B5..N5..`5......
0x3e36878350500883505009c350500ac350500x5...5...5...5..
0x3e37800000000ce350500e0350500ee350500.....5...5...5..
0x3e3880036050014360500243605002e360500.6...6..$6...6..
⋯10 more rows
0x3e438e0380500f43805000a3905001e390500.8...8...9...9..
0x3e4483639050048390500603905006e39050069..H9..`9..n9..
0x3e458803905008e3905009e390500b2390500.9...9...9...9..
⋯10 more rows
Query/set system parameters (string) 0x5391a–0x539ba
0x5391a6765000000005472616e736c6174654dge....TranslateM
0x5392a4449537973416363656c000000005472DISysAccel....Tr
0x5393a61636b506f7075704d656e7500000000ackPopupMenu....
0x5394a53797374656d506172616d6574657273SystemParameters
0x5395a496e666f4100000053686f7757696e64InfoA...ShowWind
0x5396a6f770000000053686f774f776e656450ow....ShowOwnedP
⋯5 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.