Benign Download

Trojan-PSW.Win32.Hukle.10.e

Embedded PE binary at file offset 0x26540 (~3072 bytes)Detour-style InstallHook helper name
SHA-2569eaff4d913a0d5e676973ed9ccf07631eabe11457298600a5fd6f2b461635f2f
MaleculeO(Er)

Evidence

Query/set system parameters (symbol) 0x1f218–0x1f438
⋯11 more rows
0x1f2c833320000636f6d6d6374726c5f44726132..commctrl_Dra
0x1f2d8674c6973744d736700000000a0144200gListMsg......B.
0x1f2e81edf410062a2410017d24000089e4100[email protected].
⋯21 more rows
Query/set system parameters (string) 0x22252–0x222f2
0x222527457696e646f77526563740000004765tWindowRect...Ge
0x222627457696e646f77506c6163656d656e74tWindowPlacement
0x2227200000000497349636f6e696300000000....IsIconic....
0x2228253797374656d506172616d6574657273SystemParameters
0x22292496e666f410000005265676973746572InfoA...Register
0x222a257696e646f774d657373616765410000WindowMessageA..
⋯5 more rows
Detour-style InstallHook helper name 0x22db4–0x22e74
⋯3 more rows
0x22de40d0a5b003c2f703e5b3c623e00000000..[.</p>[<b>....
0x22df4496e7374616c6c486f6f6b00556e686fInstallHook.Unho
0x22e046f6b416c6c50726f6365737365730000okAllProcesses..
⋯7 more rows
Embedded PE binary at file offset 0x26540 (~3072 bytes) 0x26500–0x265d0
⋯3 more rows
0x265300000000000000000000000003c0f0000............<...
0x265404d5a90000300000004000000ffff0000MZ..............
0x26550b8000000000000004000000000000000........@.......
0x2656000000000000000000000000000000000................
⋯7 more rows
Query/set system parameters (symbol) Trojan-PSW.Win32.Hukle.10.e · 0x1f218–0x1f438
⋯11 more rows
0x1f2c833320000636f6d6d6374726c5f44726132..commctrl_Dra
0x1f2d8674c6973744d736700000000a0144200gListMsg......B.
0x1f2e81edf410062a2410017d24000089e4100[email protected].
⋯21 more rows
Query/set system parameters (string) Trojan-PSW.Win32.Hukle.10.e · 0x22252–0x222f2
0x222527457696e646f77526563740000004765tWindowRect...Ge
0x222627457696e646f77506c6163656d656e74tWindowPlacement
0x2227200000000497349636f6e696300000000....IsIconic....
0x2228253797374656d506172616d6574657273SystemParameters
0x22292496e666f410000005265676973746572InfoA...Register
0x222a257696e646f774d657373616765410000WindowMessageA..
⋯5 more rows
Detour-style InstallHook helper name Trojan-PSW.Win32.Hukle.10.e · 0x22db4–0x22e74
⋯3 more rows
0x22de40d0a5b003c2f703e5b3c623e00000000..[.</p>[<b>....
0x22df4496e7374616c6c486f6f6b00556e686fInstallHook.Unho
0x22e046f6b416c6c50726f6365737365730000okAllProcesses..
⋯7 more rows
Embedded PE binary at file offset 0x26540 (~3072 bytes) Trojan-PSW.Win32.Hukle.10.e · 0x26500–0x265d0
⋯3 more rows
0x265300000000000000000000000003c0f0000............<...
0x265404d5a90000300000004000000ffff0000MZ..............
0x26550b8000000000000004000000000000000........@.......
0x2656000000000000000000000000000000000................
⋯7 more rows
Detour-style InstallHook helper name embedded:pe@0x26540 · 0xabf–0xb7f
⋯3 more rows
0xaef000b8100000000010030322e63726100.........02.cra.
0xaff496e7374616c6c486f6f6b00556e696eInstallHook.Unin
0xb0f7374616c6c486f6f6b00000000007000stallHook.....p.
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.