Benign Download

Backdoor.Win32.Prorat.19.afx

Embedded PE binary at file offset 0x2959 (~45056 bytes)References the Windows debugger output API
SHA-256562d5429518b2ff7de0fea59d33f12969df47770b302d4e1bcc610f4bb0f8fdb
MaleculeO(Er)H(Po)

Evidence

Embedded PE binary at file offset 0x2959 (~45056 bytes) 0x2919–0x29e9
⋯3 more rows
0x294900000000000000000000000000000000................
0x29594d5a90000300000004000000ffff0000MZ..............
0x2969b8000000000000004000000000000000........@.......
0x297900000000000000000000000000000000................
⋯7 more rows
References the Windows debugger output API 0xb2ab–0xb37b
⋯3 more rows
0xb2db4973426164577269746550747200f501IsBadWritePtr...
0xb2eb4f75747075744465627567537472696eOutputDebugStrin
0xb2fb67410000ff026c737472636d70694100gA....lstrcmpiA.
0xb30bc3025669727475616c50726f74656374..VirtualProtect
⋯7 more rows
Detour-style InstallHook helper name 0xb6f4–0xb7b4
⋯3 more rows
0xb7244c4c2e646c6c00486f6f6b50726f6300LL.dll.HookProc.
0xb734496e7374616c6c486f6f6b0052656d6fInstallHook.Remo
0xb7447665486f6f6b00000000000000000000veHook..........
⋯7 more rows
Query/set system parameters (string) 0x12071c–0x1207bc
0x12071c000053686f774f776e6564506f707570..ShowOwnedPopup
0x12072c7300000053686f775363726f6c6c4261s...ShowScrollBa
0x12073c7200000053686f7757696e646f770000r...ShowWindow..
0x12074c53797374656d506172616d6574657273SystemParameters
0x12075c496e666f41000000547261636b506f70InfoA...TrackPop
0x12076c75704d656e7500005472616e736c6174upMenu..Translat
⋯5 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.