Benign Download

Backdoor.Win32.Assasin.11

Embedded PE binary at file offset 0x2ed4 (~275140 bytes)Execute shell command (ShellExecuteA)
SHA-25667cd8f970e1229588e8d823ba0d8bba5977c64aecf421eb5a21a33b6f528a7a4
MaleculeO(Er)H(Po)

Evidence

Detour-style InstallHook helper name 0x240d–0x24cd
⋯3 more rows
0x243d65796c6f67676572444c4c2e646c6c00eyloggerDLL.dll.
0x244d496e7374616c6c486f6f6b00556e696eInstallHook.Unin
0x245d7374616c6c486f6f6b00000000000000stallHook.......
⋯7 more rows
Embedded PE binary at file offset 0x2ed4 (~275140 bytes) 0x2e94–0x2f64
⋯3 more rows
0x2ec400000000000000000000000000000000................
0x2ed44d5a90000300000004000000ffff0000MZ..............
0x2ee4b8000000000000004000000000000000........@.......
0x2ef400000000000000000000000000000000................
⋯7 more rows
Query/set system parameters (string) 0xa60e–0xa6ae
0xa60e6561746549636f6e46726f6d5265736feateIconFromReso
0xa61e75726365457800005b0147657457696eurceEx..[.GetWin
0xa62e646f77506c6163656d656e7400007102dowPlacement..q.
0xa63e53797374656d506172616d6574657273SystemParameters
0xa64e496e666f4100560147657457696e646fInfoA.V.GetWindo
0xa65e774c6f6e674100000801476574466f72wLongA....GetFor
⋯5 more rows
Detour-style InstallHook helper name Backdoor.Win32.Assasin.11 · 0x240d–0x24cd
⋯3 more rows
0x243d65796c6f67676572444c4c2e646c6c00eyloggerDLL.dll.
0x244d496e7374616c6c486f6f6b00556e696eInstallHook.Unin
0x245d7374616c6c486f6f6b00000000000000stallHook.......
⋯7 more rows
Embedded PE binary at file offset 0x2ed4 (~275140 bytes) Backdoor.Win32.Assasin.11 · 0x2e94–0x2f64
⋯3 more rows
0x2ec400000000000000000000000000000000................
0x2ed44d5a90000300000004000000ffff0000MZ..............
0x2ee4b8000000000000004000000000000000........@.......
0x2ef400000000000000000000000000000000................
⋯7 more rows
Query/set system parameters (string) Backdoor.Win32.Assasin.11 · 0xa60e–0xa6ae
0xa60e6561746549636f6e46726f6d5265736feateIconFromReso
0xa61e75726365457800005b0147657457696eurceEx..[.GetWin
0xa62e646f77506c6163656d656e7400007102dowPlacement..q.
0xa63e53797374656d506172616d6574657273SystemParameters
0xa64e496e666f4100560147657457696e646fInfoA.V.GetWindo
0xa65e774c6f6e674100000801476574466f72wLongA....GetFor
⋯5 more rows
Execute shell command (ShellExecuteA) embedded:pe@0x2ed4 · 0x1300–0x13f0
⋯3 more rows
0x1330000000000000000031000000bd194100........1.....A.
0x134020000000000000000000000000000000 ...............
0x135003000000041a41000000000000000000......A.........
⋯10 more rows
Query/set system parameters (symbol) embedded:pe@0x2ed4 · 0x13fc–0x159c
0x13fc05d04000117142005a8f420090764200[email protected].
0x140cd4764200c6704200ae684200c8804200.vB..pB..hB...B.
0x141c2b8842007f8e42000b8b4200c82c4000+.B...B...B..,@.
0x142c302040000000000000000000000000000 @.............
0x143c0000000000000000000000002ce74200............,.B.
⋯22 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.