Benign Download

Backdoor.Win32.Turkojan.amr

Image list icon size importExecute shell command (ShellExecuteA)

SHA-256a9f2b6ebd4e3ef909094b0ed8712873bf59b5f7e5fc2f72bb80e638a2fb03e17

Evidence

Query/set system parameters (string) 0x12857c–0x12861c

0x12857c6765000000005472616e736c6174654dge....TranslateM
0x12858c4449537973416363656c000000005472DISysAccel....Tr
0x12859c61636b506f7075704d656e7500000000ackPopupMenu....
0x1285ac53797374656d506172616d6574657273SystemParameters
0x1285bc496e666f4100000053686f7757696e64InfoA...ShowWind
0x1285cc6f770000000053686f775363726f6c6cow....ShowScroll
⋯5 more rows

Query/set system parameters (symbol) 0x12a590–0x12a680

0x12a590443c813cb13cc53ceb3cff3cba3d163eD<.<.<.<.<.<.=.>
0x12a5a0533eb03ff73f000000e00000b0010000S>.?.?..........
0x12a5b023305130753081309a30a430ae30c030#0Q0u0.0.0.0.0.0
0x12a5c0d530e030e530ea30f7300d3114312631.0.0.0.0.0.1.1&1
0x12a5d02b313b3145317b319931b631c8311432+1;1E1{1.1.1.1.2
⋯11 more rows

Execute shell command (ShellExecuteA) 0x12a6c8–0x12a998

⋯27 more rows
0x12a8788f3895389a38a538ab38b038bb38c138.8.8.8.8.8.8.8.8
0x12a888c638d138f339ff390c3a1e3a4e3a523a.8.8.9.9.:.:N:R:
0x12a898563a6e3a7c3a803a9c3aa43aa83aac3aV:n:|:.:.:.:.:.:
0x12a8a8b03ab43ab83abc3ac03ac43ac83acc3a.:.:.:.:.:.:.:.:
⋯4 more rows
0x12a8f8e03be43be83bec3bf03bf43b103c303c.;.;.;.;.;.;.<0<
0x12a908383c3c3c403c443c483c4c3c503c543c8<<<@<D<H<L<P<T<
0x12a918583c743c943c9c3ca03ca43ca83cac3cX<t<.<.<.<.<.<.<
0x12a928b03cb43cb83cbc3cd83cf83c003d043d.<.<.<.<.<.<.=.=
⋯7 more rows