Benign Download

Backdoor.Win32.Hupigon.fraa

Embedded PE binary at file offset 0x9cfcc (~62004 bytes)Image list icon size import

SHA-256575d941b9f438e44434984a7a5633a68f6b73cc7281827046e365d17f25f2106

Evidence

Embedded PE binary at file offset 0x9cfcc (~62004 bytes) 0x9cf8c–0x9d05c

⋯3 more rows
0x9cfbc1c8a4800308a4800616978696172616e..H.0.H.aixiaran
0x9cfcc4d5a90000300000004000000ffff0000MZ..............
0x9cfdcb8000000000000004000000000000000........@.......
0x9cfec00000000000000000000000000000000................
⋯7 more rows

Query/set system parameters (string) 0xa2120–0xa21c0

0xa21206765000000005472616e736c6174654dge....TranslateM
0xa21304449537973416363656c000000005472DISysAccel....Tr
0xa214061636b506f7075704d656e7500000000ackPopupMenu....
0xa215053797374656d506172616d6574657273SystemParameters
0xa2160496e666f4100000053686f7757696e64InfoA...ShowWind
0xa21706f770000000053686f775363726f6c6cow....ShowScroll
⋯5 more rows

Query/set system parameters (symbol) 0xa9620–0xa9710

0xa96207500700070006f007200740020004900u.p.p.o.r.t. .I.
0xa963063006f006e0073001500430061006e00c.o.n.s...C.a.n.
0xa96406e006f00740020006f00700065006e00n.o.t. .o.p.e.n.
0xa9650200063006c006900700062006f006100 .c.l.i.p.b.o.a.
0xa9660720064002f004d0065006e0075002000r.d./.M.e.n.u. .
⋯11 more rows

Execute shell command (ShellExecuteA) 0xa9814–0xa99e4

⋯13 more rows
0xa98e46f0072000b0049006e0066006f007200o.r...I.n.f.o.r.
0xa98f46d006100740069006f006e0007004300m.a.t.i.o.n...C.
0xa99046f006e006600690072006d0004002600o.n.f.i.r.m...&.
0xa9914590065007300030026004e006f000200Y.e.s...&.N.o...
0xa99244f004b000600430061006e0063006500O.K...C.a.n.c.e.
0xa99346c0005002600480065006c0070000600l...&.H.e.l.p...
0xa99442600410062006f007200740006002600&.A.b.o.r.t...&.
0xa995452006500740072007900000000000000R.e.t.r.y.......
0xa996400000000000000000000000000000000................
0xa997400000000000000000000000013004d00..............M.
⋯7 more rows