Benign Download

Trojan-PSW.Win32.Tibia.my

Image list icon size importExecute shell command (ShellExecuteA)

SHA-256ac1d1a9abe2835e69f0bc5d4091f1b23e6e156e1ab07b220886f437c2d4e7230

Evidence

Query/set system parameters (string) 0x556ce–0x5576e

0x556ce6765000000005472616e736c6174654dge....TranslateM
0x556de4449537973416363656c000000005472DISysAccel....Tr
0x556ee61636b506f7075704d656e7500000000ackPopupMenu....
0x556fe53797374656d506172616d6574657273SystemParameters
0x5570e496e666f4100000053686f7757696e64InfoA...ShowWind
0x5571e6f770000000053686f775363726f6c6cow....ShowScroll
⋯5 more rows

Query/set system parameters (symbol) 0x57434–0x57524

0x574347c3884388838903894389c38a038a838|8.8.8.8.8.8.8.8
0x57444ac38b438b838c738d338de38f238fd38.8.8.8.8.8.8.8.8
0x57454073912391c39273931393b3941394b39.9.9.9'919;9A9K9
0x5746451395b39663970397b39853990399a39Q9[9f9p9{9.9.9.9
0x57474a539af39ba39c439ce39d839e239ec39.9.9.9.9.9.9.9.9
⋯11 more rows

Execute shell command (ShellExecuteA) 0x57604–0x577c4

⋯12 more rows
0x576c4ab38ba38d13803393f394e3965398d39.8.8.8.9?9N9e9.9
0x576d49b39aa39c139f3392f3a3e3a553a7d3a.9.9.9.9/:>:U:}:
0x576e48b3a9a3ab13ade3a653b743b953ba43b.:.:.:.:e;t;.;.;
0x576f4bb3bca3be13bf03b073c163c2d3c3c3c.;.;.;.;.<.<-<<<
0x57704533c623c763c853c963cc83cd73cee3cS<b<v<.<.<.<.<.<
0x57714653d733d823d993d00f00000d8000000e=s=.=.=........
0x57724083023333133d0330834373452346834.0#313.3.474R4h4
0x57734c83400351735303578359535cd35e635.4.5.505x5.5.5.5
0x57744fd3550368036b536d136d536d936dd36.5P6.6.6.6.6.6.6
0x57754e136e536e936ed36f136f536f936fd36.6.6.6.6.6.6.6.6
⋯7 more rows