Benign Download

Trojan-Banker.Win32.Banker.iku

Image list icon size importExecute shell command (ShellExecuteA)

SHA-256502539a65ab5da1cf89badd7d40509a8e1a106c0b5a35e5fd8e8093c3f2cd2f7

Evidence

Query/set system parameters (string) 0x5f0de–0x5f17e

0x5f0de6765000000005472616e736c6174654dge....TranslateM
0x5f0ee4449537973416363656c000000005472DISysAccel....Tr
0x5f0fe61636b506f7075704d656e7500000000ackPopupMenu....
0x5f10e53797374656d506172616d6574657273SystemParameters
0x5f11e496e666f4100000053686f7757696e64InfoA...ShowWind
0x5f12e6f770000000053686f775363726f6c6cow....ShowScroll
⋯5 more rows

Query/set system parameters (symbol) 0x6043c–0x6051c

0x6043ca633ae33b633be33c633ce33d633de33.3.3.3.3.3.3.3.3
0x6044ce633ee33f633fe3306340e3416341e34.3.3.3.3.4.4.4.4
0x6045c26342e3436343e3446344e3456345e34&4.464>4F4N4V4^4
0x6046c66346e3476347e3486348e3496349e34f4n4v4~4.4.4.4.4
0x6047ca634ae34b634be34c634ce34d634de34.4.4.4.4.4.4.4.4
⋯10 more rows

Execute shell command (ShellExecuteA) 0x6060c–0x607cc

⋯12 more rows
0x606cc04300c3014301c3024302c3034303c30.0.0.0.0$0,040<0
0x606dc44304c3054305c3064306c3074308330D0L0T0\0d0l0t0.0
0x606ec8f309c30ae30b430c030d430dc30e030.0.0.0.0.0.0.0.0
0x606fce430e830ec30f030f430f830fc300a31.0.0.0.0.0.0.0.1
0x6070c1c313c31443148314c31503154315831.1<1D1H1L1P1T1X1
0x6071c5c31603164317031903198319c31a031\1`1d1p1.1.1.1.1
0x6072ca431a831ac31b031b431b831cc31ec31.1.1.1.1.1.1.1.1
0x6073cf431f831fc310032043208320c321032.1.1.1.2.2.2.2.2
0x6074c1432283248325032543258325c326032.2(2H2P2T2X2\2`2
0x6075c643268326c3270328032a032a832ac32d2h2l2p2.2.2.2.2
⋯7 more rows