Benign Download

Trojan-PSW.Win32.Tibia.jo

Image list icon size importExecute shell command (ShellExecuteA)

SHA-25682324735cb6faae7e67b077846ae68deb312259e9a3a2d8553790e993fcdc681

Evidence

Query/set system parameters (string) 0x554ce–0x5556e

0x554ce6765000000005472616e736c6174654dge....TranslateM
0x554de4449537973416363656c000000005472DISysAccel....Tr
0x554ee61636b506f7075704d656e7500000000ackPopupMenu....
0x554fe53797374656d506172616d6574657273SystemParameters
0x5550e496e666f4100000053686f7757696e64InfoA...ShowWind
0x5551e6f770000000053686f775363726f6c6cow....ShowScroll
⋯5 more rows

Query/set system parameters (symbol) 0x57434–0x57524

0x57434043608360c3610361436303650365836.6.6.6.6.606P6X6
0x574445c366036643668366c36703674367836\6`6d6h6l6p6t6x6
0x574549836b836c036c436c836cc36d036d436.6.6.6.6.6.6.6.6
0x57464d836dc36e0360037203728372c373037.6.6.6.7 7(7,707
0x57474343738373c37403744374837643784374787<[email protected]
⋯11 more rows

Execute shell command (ShellExecuteA) 0x57604–0x577c4

⋯12 more rows
0x576c4183d203d283d303d383d403d483d503d.= =(=0=8=@=H=P=
0x576d4583d603d683d703d783d803d883d903dX=`=h=p=x=.=.=.=
0x576e4983da03da83db03db83dc03dc83dd03d.=.=.=.=.=.=.=.=
0x576f4d83de03def3dfb3d083e1a3ec83edd3e.=.=.=.=.>.>.>.>
0x57704001001005c02000036315f31c0316132....\...61_1.1a2
0x57714c032c432c832cc32d032d43216335c33.2.2.2.2.2.2.3\3
0x577246033643368336c337033ce33ef33f333`3d3h3l3p3.3.3.3
0x57734f733fb33ff3303345534b735c335ca35.3.3.3.4U4.5.5.5
0x57744d435df35f13502360f361b3628363a36.5.5.5.6.6.6(6:6
0x57754403659368c36a536b436cc3624373537@6Y6.6.6.6.6$757
⋯7 more rows