Benign Download

Trojan-PSW.Win32.Delf.agv

Embedded PE binary at file offset 0x98000 (~81920 bytes)Image list icon size import
SHA-2567f2b7de4edbcacd733e8f73849a9f9ac089700a9ca1eaa65d755316bb2db57ff
MaleculeH₂(PoU)

Evidence

Query/set system parameters (string) 0x810–0x8b0
0x8106c6174654d657373616765005472616elateMessage.Tran
0x820736c6174654d4449537973416363656cslateMDISysAccel
0x83000547261636b506f7075704d656e7500.TrackPopupMenu.
0x84053797374656d506172616d6574657273SystemParameters
0x850496e666f410053686f7757696e646f77InfoA.ShowWindow
0x8600053686f775363726f6c6c4261720053.ShowScrollBar.S
⋯5 more rows
Execute shell command (ShellExecuteA) 0x89494–0x89784
0x894941101250000000000b5f32400c5f32400..%.......$...$.
0x894a4d5f32400e2f32400ebf32400f7f32400..$...$...$...$.
0x894b404f4240015f4240029f424003af42400..$...$.).$.:.$.
0x894c44ff424005ef4240074f424007ff42400O.$.^.$.t.$...$.
0x894d48df424009df42400a8f42400b5f42400..$...$...$...$.
⋯43 more rows
Embedded PE binary at file offset 0x98000 (~81920 bytes) 0x97fc0–0x98090
⋯3 more rows
0x97ff000000000000000000000000000000000................
0x980004d5a0000000000000000000050450000MZ..........PE..
0x980104c010200465347210000000000000000L...FSG!........
0x98020e0000f010b0100000078000000220000.........x..."..
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.