Benign Download

Worm.Win32.AutoRun.tv

Embedded PE binary at file offset 0xf4a8 (~584983 bytes)Winsock provider catalog persistence
SHA-256bb96bef871fab61214a8ecfabbfd25d7aab10c21c95841aaf03030ce3d22ed6d
MaleculeO(P)H(Po)

Evidence

Winsock provider catalog persistence 0xdf95–0xe075
⋯3 more rows
0xdfc574726f6c5365745c5365727669636573trolSet\Services
0xdfd55c57696e536f636b325c506172616d65\WinSock2\Parame
0xdfe5746572735c50726f746f636f6c5f4361ters\Protocol_Ca
0xdff574616c6f67395c436174616c6f675f45talog9\Catalog_E
0xe0056e747269657300558bec51538945fc8bntries.U..QS.E..
⋯7 more rows
Embedded PE binary at file offset 0xf4a8 (~584983 bytes) 0xf468–0xf538
⋯3 more rows
0xf49800000000000000000000000000000000................
0xf4a84d5a50000200000004000f00ffff0000MZP.............
0xf4b8b80000000000000040001a0000000000........@.......
0xf4c800000000000000000000000000000000................
⋯7 more rows
Query/set system parameters (string) 0x86a54–0x86af4
0x86a546e646f7700000000556e726567697374ndow....Unregist
0x86a646572436c61737341000000005472616eerClassA....Tran
0x86a74736c6174654d65737361676500000000slateMessage....
0x86a8453797374656d506172616d6574657273SystemParameters
0x86a94496e666f4100000053686f7757696e64InfoA...ShowWind
0x86aa46f770000000053657457696e646f7773ow....SetWindows
⋯5 more rows
References the Windows debugger output API 0x870a8–0x87178
⋯3 more rows
0x870d85065656b4e616d656450697065000000PeekNamedPipe...
0x870e84f75747075744465627567537472696eOutputDebugStrin
0x870f86741000000004f70656e50726f636573gA....OpenProces
0x87108730000004f70656e46696c654d617070s...OpenFileMapp
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.