Benign Download

Constructor.Win32.Delf.eg

Embedded PE binary at file offset 0xc64b4 (~761856 bytes)Image list icon size import

SHA-2567e6daae534a110b6ae50be27b4a5f643afcc9fc3903d5096a0da413ed4502e8a

Evidence

Query/set system parameters (string) 0xaaf30–0xaafd0

0xaaf306765000000005472616e736c6174654dge....TranslateM
0xaaf404449537973416363656c000000005472DISysAccel....Tr
0xaaf5061636b506f7075704d656e7500000000ackPopupMenu....
0xaaf6053797374656d506172616d6574657273SystemParameters
0xaaf70496e666f4100000053686f7757696e64InfoA...ShowWind
0xaaf806f770000000053686f775363726f6c6cow....ShowScroll
⋯5 more rows

Query/set system parameters (symbol) 0xad488–0xad578

0xad4884c3f503f543f583f5c3f603f703f903fL?P?T?X?\?`?p?.?
0xad498983f9c3fa03fa43fa83fac3fb03fb43f.?.?.?.?.?.?.?.?
0xad4a8b83fc83fe83ff03ff43ff83ffc3f0000.?.?.?.?.?.?.?..
0xad4b800200100540400000030043008300c30. ..T....0.0.0.0
0xad4c810302030403048304c30503054305830.0 0@0H0L0P0T0X0
⋯11 more rows

Execute shell command (ShellExecuteA) 0xad67c–0xad85c

⋯13 more rows
0xad74cac39b039b439b839bc39c039c439c839.9.9.9.9.9.9.9.9
0xad75ccc39d039d439d839dc39e039e439e839.9.9.9.9.9.9.9.9
0xad76cec39f039f439f839fc39003a043a083a.9.9.9.9.9.:.:.:
0xad77c0c3a103a143a183a1c3a203a243a283a.:.:.:.:.: :$:(:
0xad78c2c3a303a343a383a3c3a403a443a543a,:0:4:8:<:@:D:T:
0xad79c653a693a7c3a9c3aa43aa83aac3ab03ae:i:|:.:.:.:.:.:
0xad7acb43ab83abc3ac03ac43ac83acc3ad03a.:.:.:.:.:.:.:.:
0xad7bcd43ad83adc3ae03aec3af93afd3a103b.:.:.:.:.:.:.:.;
0xad7cc303b383b3c3b403b443b483b4c3b503b0;8;<;@;D;H;L;P;
0xad7dc543b583b5c3b603b643b683b6c3b703bT;X;\;`;d;h;l;p;
0xad7ec743b883ba83bb03bb43bb83bbc3bc03bt;.;.;.;.;.;.;.;
⋯7 more rows

Embedded PE binary at file offset 0xc64b4 (~761856 bytes) 0xc6474–0xc6544

⋯3 more rows
0xc64a4263d4f38c28237b8f3244203179b3a83&=O8..7..$B...:.
0xc64b44d5a50000200000004000f00ffff0000MZP.............
0xc64c4b80000000000000040001a0000000000........@.......
0xc64d400000000000000000000000000000000................
⋯7 more rows