Suspicious ^80% Download

Trojan-Spy.Win32.Agent.k

Trojan spyware with hooks

Embedded PE binary at file offset 0x3ba60 (~45488 bytes)References the Windows debugger output API

SHA-25692fa22c033e455555ae56ca39d50a408773591ed4e167da3ead246b06efc4a31

Evidence

Detour-style InstallHook helper name 0x32e1c–0x32edc

⋯3 more rows
0x32e4c6174652e646174007762000072620000ate.dat.wb..rb..
0x32e5c496e7374616c6c486f6f6b007259a09bInstallHook.rY..
0x32e6ca8f6cf11a44200a0c90a8f3952656769.....B.....9Regi
⋯7 more rows

Execute shell command (ShellExecuteA) 0x330d0–0x33240

⋯13 more rows
0x331a00bcf0ee49dff099327ae000ab19e077d........'......}
0x331b044930ff0d2a3088768f2011efec20669D.......h......i
0x331c05d5762f7cb67658071366c19e7066b6e]Wb..ge.q6l...kn
0x331d0761bd4fee02bd3895a7ada10cc4add67v....+..Zz...J.g
⋯7 more rows

References the Windows debugger output API 0x38c0e–0x38cde

⋯3 more rows
0x38c3e784100004f70656e4d75746578410000xA..OpenMutexA..
0x38c4e4f75747075744465627567537472696eOutputDebugStrin
0x38c5e674100005465726d696e61746550726fgA..TerminatePro
0x38c6e636573730000496e7465726c6f636b65cess..Interlocke
⋯7 more rows

Embedded PE binary at file offset 0x3ba60 (~45488 bytes) 0x3ba20–0x3baf0

⋯3 more rows
0x3ba500000000000000000030044004c004c00..........D.L.L.
0x3ba604d5a90000300000004000000ffff0000MZ..............
0x3ba70b8000000000000004000000000000000........@.......
0x3ba8000000000000000000000000000000000................
⋯7 more rows