Benign Download

Backdoor.Win32.Delf.byy

Image list icon size importExecute shell command (ShellExecuteA)

SHA-256af2414137584782f929c99209e1c29587667badbaa8f72fe89eb3a78bd5aee23

Evidence

Query/set system parameters (string) 0x7eece–0x7ef6e

0x7eece6765000000005472616e736c6174654dge....TranslateM
0x7eede4449537973416363656c000000005472DISysAccel....Tr
0x7eeee61636b506f7075704d656e7500000000ackPopupMenu....
0x7eefe53797374656d506172616d6574657273SystemParameters
0x7ef0e496e666f4100000053686f7757696e64InfoA...ShowWind
0x7ef1e6f770000000053686f775363726f6c6cow....ShowScroll
⋯5 more rows

Query/set system parameters (symbol) 0x82488–0x82578

0x8248880000000ab30183195319732d032e732.....0.1.1.2.2.2
0x824980a332f334d33ea33da347a359836cc36.3/3M3.3.4z5.6.6
0x824a87837a737f73717384d38ec38fc380c39x7.7.7.8M8.8.8.9
0x824b8143918391c392039243928392c393039.9.9.9 9$9(9,909
0x824c8343938393c394039443948394c3960394989<9@9D9H9L9`9
⋯11 more rows

Execute shell command (ShellExecuteA) 0x8265c–0x8282c

⋯13 more rows
0x8272c9832a032a632b232ba322b3333333933.2.2.2.2.2+33393
0x8273c4533523370338233c933d133d733e333E3R3p3.3.3.3.3.3
0x8274ceb332734323452349d34a534ab34b734.3'424R4.4.4.4.4
0x8275cbf34fb3406352635713579357f358b35.4.4.5&5q5y5.5.5
0x8276c9335cf35da35fa3545364d3653365f36.5.5.5.5E6M6S6_6
0x8277c6f3694369f3665376f37753779377f37o6.6.6e7o7u7y7.7
0x8278c833789378d37933797379d37a137a737.7.7.7.7.7.7.7.7
0x8279cab37b137b537bb37bf37d737e337f037.7.7.7.7.7.7.7.7
0x827ac0238173823383038423848385b388038.8.8#808B8H8[8.8
0x827bc9138b438cb38f03809392c3947396c39.8.8.8.8.9,9G9l9
⋯7 more rows