Benign Download

Backdoor.Win32.Agent.wp

Image list icon size importExecute shell command (ShellExecuteA)
SHA-2566eeba13db01d27b5658da45142de871a50d3d60070f24d8bafb6c56984100d5e
MaleculeH₂(PoU)

Evidence

Query/set system parameters (string) 0xa3878–0xa3918
0xa3878654d65737361676500005472616e736ceMessage..Transl
0xa38886174654d4449537973416363656c0000ateMDISysAccel..
0xa3898547261636b506f7075704d656e750000TrackPopupMenu..
0xa38a853797374656d506172616d6574657273SystemParameters
0xa38b8496e666f4100000053686f7757696e64InfoA...ShowWind
0xa38c86f77000053686f775363726f6c6c4261ow..ShowScrollBa
⋯5 more rows
Query/set system parameters (symbol) 0xa6514–0xa66e4
0xa651400000000000000000000000000000000................
0xa652400000000000000000000000000000000................
0xa653400000000000000000000000000000000................
0xa654400000000000000000000000000000000................
0xa655400000000000000000000000000000000................
⋯25 more rows
Execute shell command (ShellExecuteA) 0xa680c–0xa693c
⋯3 more rows
0xa683c00000000000000000000000000000000................
0xa684c00000000000000000000000000000000................
0xa685c00000000000000000000000000000000................
0xa686c00000000000000000000000000000000................
0xa687c00000000000000000000000000000000................
0xa688c00000000000000000000000000000000................
0xa689c00000000000000000000000000000000................
0xa68ac00000000000000000000000000000000................
0xa68bc00000000000000000000000000000000................
0xa68cc00000000000000000000000000000000................
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.