Benign Download

Trojan-Downloader.Win32.Small.wsj

CreateRemoteThread API stringEmbedded PE binary at file offset 0x705a0 (~36864 bytes)

SHA-25672f43455bb73c1f76dea809e63339829da636136f5ef242e73ab5efd84de246c

Evidence

Query/set system parameters (symbol) 0x5a3f0–0x5a4e0

0x5a3f0f12a1700002b170000000000092b1700.*...+.......+..
0x5a4001b2b17002d2b1700382b1700462b1700.+..-+..8+..F+..
0x5a410552b1700682b17007e2b1700912b1700U+..h+..~+...+..
0x5a420a82b1700b92b1700d12b1700de2b1700.+...+...+...+..
0x5a430ee2b1700002c17000d2c1700212c1700.+...,...,..!,..
⋯11 more rows

Image list icon size import 0x5a510–0x5a760

⋯23 more rows
0x5a680cd341700e2341700f434170008351700.4...4...4...5..
0x5a69016351700253517000000000033351700.5..%5......35..
0x5a6a04b351700633517007535170086351700K5..c5..u5...5..
0x5a6b09f351700ba351700d9351700ee351700.5...5...5...5..
0x5a6c0043617001a3617002e36170044361700.6...6...6..D6..
⋯10 more rows

Query/set system parameters (string) 0x65bd4–0x65c74

0x65bd4616e736c6174654d6573736167655472anslateMessageTr
0x65be4616e736c6174654d4449537973416363anslateMDISysAcc
0x65bf4656c547261636b506f7075704d656e75elTrackPopupMenu
0x65c0453797374656d506172616d6574657273SystemParameters
0x65c14496e666f4153686f7757696e646f7753InfoAShowWindowS
0x65c24686f775363726f6c6c42617253686f77howScrollBarShow
⋯5 more rows

Embedded PE binary at file offset 0x705a0 (~36864 bytes) 0x70560–0x70630

⋯3 more rows
0x70590263d4f38c28237b8f3244203179b3a83&=O8..7..$B...:.
0x705a04d5a50000200000004000f00ffff0000MZP.............
0x705b0b80000000000000040001a0000000000........@.......
0x705c000000000000000000000000000000000................
⋯7 more rows

CreateRemoteThread API string 0x71dbe–0x71e8e

⋯3 more rows
0x71dee6f64756c6548616e646c654100000000oduleHandleA....
0x71dfe43726561746552656d6f746554687265CreateRemoteThre
0x71e0e616400000000436c6f736548616e646cad....CloseHandl
0x71e1e65007573657233322e646c6c00000000e.user32.dll....
⋯7 more rows