Benign Download

Trojan-Clicker.Win32.Delf.az

Embedded PE binary at file offset 0x1975c (~502660 bytes)Image list icon size import
SHA-256a7be751c20c91ae9f9500ff0adf8535426b1d21072eb47bf539356300bc22e0b
MaleculeH₂(PoU)

Evidence

Execute shell command (ShellExecuteA) 0x182a4–0x18394
⋯5 more rows
0x182f401000400000000008002000000000000................
0x1830400000000000000000000000000000000................
0x1831400008000008000000080800080000000................
0x18324800080008080000080808000c0c0c000................
⋯7 more rows
Embedded PE binary at file offset 0x1975c (~502660 bytes) 0x1971c–0x197ec
⋯3 more rows
0x1974c0000bb616374696f6e5f756e00000000...action_un....
0x1975c4d5a50000200000004000f00ffff0000MZP.............
0x1976cb80000000000000040001a0000000000........@.......
0x1977c00000000000000000000000000000000................
⋯7 more rows
Query/set system parameters (string) 0x83d48–0x83de8
0x83d486765000000005472616e736c6174654dge....TranslateM
0x83d584449537973416363656c000000005472DISysAccel....Tr
0x83d6861636b506f7075704d656e7500000000ackPopupMenu....
0x83d7853797374656d506172616d6574657273SystemParameters
0x83d88496e666f4100000053686f7757696e64InfoA...ShowWind
0x83d986f770000000053686f775363726f6c6cow....ShowScroll
⋯5 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.