Benign Download

Backdoor.Win32.Small.gdj

CreateRemoteThread API referenceCreateRemoteThread API string
SHA-256426aaf386521c910a88e9bc9cc7baf70f05168761a1b37c3bc62f6cb25a103f6
MaleculeH(Po₂)Md(Bi)

Evidence

Small high-entropy writable .data section 0x3c0–0x4a0
⋯3 more rows
0x3f000000000000000000000000000000000................
0x400a5620000bc620000d1620000e5620000.b...b...b...b..
0x410fa620000116300002463000032630000.b...c..$c..2c..
0x4204d63000060630000756300008c630000Mc..`c..uc...c..
0x4309c630000b5630000c5630000e1630000.c...c...c...c..
⋯7 more rows
CreateRemoteThread API string 0x67e–0x74e
⋯3 more rows
0x6ae44656661756c744c6f63616c65000000DefaultLocale...
0x6be43726561746552656d6f746554687265CreateRemoteThre
0x6ce6164000000456e756d43616c656e6461ad...EnumCalenda
0x6de72496e666f41000000456e756d526573rInfoA...EnumRes
⋯7 more rows
References the Windows debugger output API 0x7bf–0x88f
⋯3 more rows
0x7ef65617475726550726573656e74000000eaturePresent...
0x7ff4f75747075744465627567537472696eOutputDebugStrin
0x80f675700000053657448616e646c65496egW...SetHandleIn
0x81f666f726d6174696f6e00000053797374formation...Syst
⋯7 more rows
CreateRemoteThread API reference 0x5fc4–0x6094
⋯3 more rows
0x5ff4216c8f733e1a9df794879e52c501ad19!l.s>......R....
0x6004e7eb9dda368400a8ca698684932696a8....6....i...&..
0x6014fc9012942266858662de148c2768ef01...."f..b...'h..
0x6024452c139a8b33093f323cf8c206baa837E,...3.?2<.....7
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.