Benign Download

Backdoor.Win32.XRat.v

Embedded PE binary at file offset 0x55b6c (~73728 bytes)Image list icon size import
SHA-2564134a4c5c79619ab088ff59373532200db100794c38577807b95881435b12d83
MaleculeH(U)

Evidence

Query/set system parameters (string) 0x4ea1a–0x4eaba
0x4ea1a6765000000005472616e736c6174654dge....TranslateM
0x4ea2a4449537973416363656c000000005472DISysAccel....Tr
0x4ea3a61636b506f7075704d656e7500000000ackPopupMenu....
0x4ea4a53797374656d506172616d6574657273SystemParameters
0x4ea5a496e666f4100000053686f7757696e64InfoA...ShowWind
0x4ea6a6f770000000053686f775363726f6c6cow....ShowScroll
⋯5 more rows
Query/set system parameters (symbol) 0x503fc–0x504ec
0x503fc3238fd39293a313a393a413a493aae3a28.9):1:9:A:I:.:
0x5040cdd3af83afc3a003b043b083b453c823d.:.:.:.;.;.;E<.=
0x5041c973da23e313f433feb3f000000900000.=.>1?C?.?......
0x5042c8c0000002d3147315131b73193323334....-1G1Q1.1.234
0x5043c67354e368436d53602376637b037eb37g5N6.6.6.7f7.7.7
⋯11 more rows
Image list icon size import 0x505cc–0x5075c
⋯12 more rows
0x5068c4e325732723285328e32ad32bb32da32N2W2r2.2.2.2.2.2
0x5069cf232fb320f331d3331334f3371338033.2.2.3.313O3q3.3
0x506ac8e33b133d333e233f233fa330f341734.3.3.3.3.3.3.4.4
0x506bc34344134023518355035573566356d3544A4.5.5P5W5f5m5
⋯10 more rows
Embedded PE binary at file offset 0x55b6c (~73728 bytes) 0x55b2c–0x55bfc
⋯3 more rows
0x55b5c4d00410049004e00490043004f004e00M.A.I.N.I.C.O.N.
0x55b6c4d5a50000200000004000f00ffff0000MZP.............
0x55b7cb80000000000000040001a0000000000........@.......
0x55b8c00000000000000000000000000000000................
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.