Benign Download

Trojan.Win32.StartPage.bdl

System drivers path templateEmbedded PE binary at file offset 0x1a00 (~8448 bytes)
SHA-2565b6e132a993e35694fbed01b0a1d3aeb08dc8bc4b7fb1d2d6884ccf8680d867a
MaleculeO(P)H(Po)

Evidence

System drivers path template 0x128c–0x13bc
⋯5 more rows
0x12dc5c53657276696365735c257300000000\Services\%s....
0x12ec73797374656d33325c64726976657273system32\drivers
0x12fc5c25732e73797300772b620025735c25\%s.sys.w+b.%s\%
0x130c732e7379730000006d73716d78000000s.sys...msqmx...
⋯11 more rows
References the Windows debugger output API 0x1678–0x1748
⋯3 more rows
0x16a87450726f634164647265737300008102tProcAddress....
0x16b84f75747075744465627567537472696eOutputDebugStrin
0x16c86741000048024c6f61644c6962726172gA..H.LoadLibrar
0x16d8794100002e00436c6f736548616e646cyA....CloseHandl
⋯7 more rows
Embedded PE binary at file offset 0x1a00 (~8448 bytes) 0x19c0–0x1a90
⋯3 more rows
0x19f000000000000000000000000000000000................
0x1a004d5a90000300000004000000ffff0000MZ..............
0x1a10b8000000000000004000000000000000........@.......
0x1a2000000000000000000000000000000000................
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.