Benign Download

Trojan-Downloader.Win32.Banload.sns

CreateRemoteThread API referenceCreateRemoteThread API string
SHA-256a103fc374fce2c0c6ac47b0f249cbda7dd2ba76a6d9231f060d5d00c76841166
MaleculeH₂(PoU)

Evidence

CreateRemoteThread API string 0x79990–0x79a60
⋯3 more rows
0x799c043726561746554687265616400000000CreateThread....
0x799d043726561746552656d6f746554687265CreateRemoteThre
0x799e061640000000043726561746550726f63ad....CreateProc
0x799f065737341000000004372656174654d75essA....CreateMu
⋯7 more rows
Query/set system parameters (string) 0x79fe0–0x7a080
0x79fe06765000000005472616e736c6174654dge....TranslateM
0x79ff04449537973416363656c000000005472DISysAccel....Tr
0x7a00061636b506f7075704d656e7500000000ackPopupMenu....
0x7a01053797374656d506172616d6574657273SystemParameters
0x7a020496e666f4100000053686f7757696e64InfoA...ShowWind
0x7a0306f774173796e6300000053686f775769owAsync...ShowWi
⋯5 more rows
CreateRemoteThread API reference 0x7c348–0x7c418
⋯3 more rows
0x7c378423146314a314e31523156315a315e31B1F1J1N1R1V1Z1^1
0x7c388623166316a316e31723176317a317e31b1f1j1n1r1v1z1~1
0x7c39882319131ce31e331f8310d32f032f432.1.1.1.1.1.2.2.2
0x7c3a8f832fc320033043308330c3310331433.2.2.3.3.3.3.3.3
⋯7 more rows
Query/set system parameters (symbol) 0x7c4c0–0x7c5b0
0x7c4c0733f773f7b3f7f3f833f873f8b3f8f3fs?w?{?.?.?.?.?.?
0x7c4d0933f973f9b3f9f3fa33fa73fab3f0000.?.?.?.?.?.?.?..
0x7c4e00020010020010000d930fd305b31b631. .. ....0.0[1.1
0x7c4f0003242325b327432f432f832fc320033.2B2[2t2.2.2.2.3
0x7c500043308330c331033143318331c332033.3.3.3.3.3.3.3 3
⋯11 more rows
Image list icon size import 0x7c6a0–0x7c880
⋯17 more rows
0x7c7b00d3f1e3f243f3d3f483f563f783f8c3f.?.?$?=?H?V?x?.?
0x7c7c0b03fca3fd23fda3fe43ff43f00500100.?.?.?.?.?.?.P..
0x7c7d094030000183028304c3069308c30a330.....0(0L0i0.0.0
0x7c7e0c430d530f830103134314e3170317e31.0.0.0.141N1p1~1
⋯10 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.