Benign Download

Backdoor.Win32.Polka.l

Image list icon size importExecute shell command (ShellExecuteA)

SHA-25640a3dbb4588242872f04699e8ed0fb6ce32b8b9b025aac5622953ec3fa88a112

Evidence

Query/set system parameters (string) 0x5bfb6–0x5c056

0x5bfb66765000000005472616e736c6174654dge....TranslateM
0x5bfc64449537973416363656c000000005472DISysAccel....Tr
0x5bfd661636b506f7075704d656e7500000000ackPopupMenu....
0x5bfe653797374656d506172616d6574657273SystemParameters
0x5bff6496e666f41000000537761704d6f7573InfoA...SwapMous
0x5c00665427574746f6e00000053686f775769eButton...ShowWi
⋯5 more rows

Query/set system parameters (symbol) 0x5e47c–0x5e56c

0x5e47c3b335433d4330b350f35133517351b35;3T3.3.5.5.5.5.5
0x5e48c1f35233527352b352f35333537353b35.5#5'5+5/53575;5
0x5e49c3f35433547354b354f35533557355b35?5C5G5K5O5S5W5[5
0x5e4ac5f35c635113735379e37e0371a383338_5.5.757.7.7.838
0x5e4bc4b38ca38ce38d238d638da38de38e238K8.8.8.8.8.8.8.8
⋯11 more rows

Execute shell command (ShellExecuteA) 0x5e65c–0x5e83c

⋯14 more rows
0x5e73c3d344134453449341d3685369c36b536=4A4E4I4.6.6.6.6
0x5e74cf0360d3741375a377137ac37d7371a38.6.7A7Z7q7.7.7.8
0x5e75c37386e388a388e38923896389a389e3878n8.8.8.8.8.8.8
0x5e76ca238a638aa38ae38b238b638ba38be38.8.8.8.8.8.8.8.8
0x5e77cc238c638ca38ce38d238d638da38de38.8.8.8.8.8.8.8.8
0x5e78cf0380839113b153b193b1d3b213b253b.8.9.;.;.;.;!;%;
0x5e79c293b2d3b313b353b393b3d3b413b453b);-;1;5;9;=;A;E;
0x5e7ac493b4d3b513b553b593b5d3b613b653bI;M;Q;U;Y;];a;e;
0x5e7bc393dcd3de63d113e6b3ec53e233f723f9=.=.=.>k>.>#?r?
0x5e7ccbd3fcb3f00300100f400000034345334.?.?.0......44S4
⋯7 more rows