Benign Download

Trojan-Spy.Win32.Delf.cdf

CreateRemoteThread API referenceCreateRemoteThread API string
SHA-256c0ed400ba09c346595d472f1ce34b9f600a0b0ae424d12514065589a1565e3fe
MaleculeH₂(PoU)

Evidence

CreateRemoteThread API string 0x57fc4–0x58094
⋯3 more rows
0x57ff443726561746554687265616400000000CreateThread....
0x5800443726561746552656d6f746554687265CreateRemoteThre
0x5801461640000000043726561746546696c65ad....CreateFile
0x580244d617070696e67410000000043726561MappingA....Crea
⋯7 more rows
Query/set system parameters (string) 0x584de–0x5857e
0x584de6765000000005472616e736c6174654dge....TranslateM
0x584ee4449537973416363656c000000005472DISysAccel....Tr
0x584fe61636b506f7075704d656e7500000000ackPopupMenu....
0x5850e53797374656d506172616d6574657273SystemParameters
0x5851e496e666f4100000053686f7757696e64InfoA...ShowWind
0x5852e6f770000000053686f775363726f6c6cow....ShowScroll
⋯5 more rows
CreateRemoteThread API reference 0x5a348–0x5a418
⋯3 more rows
0x5a3782b3d373d443d563d863d8a3d8e3da63d+=7=D=V=.=.=.=.=
0x5a388b43db83dd43ddc3de03de43de83dec3d.=.=.=.=.=.=.=.=
0x5a398f03df43df83dfc3d003e043e083e0c3e.=.=.=.=.>.>.>.>
0x5a3a8103e143e183e1c3e203e243e283e2c3e.>.>.>.> >$>(>,>
⋯7 more rows
Query/set system parameters (symbol) 0x5a484–0x5a574
0x5a484d831dc31e031e431e831ec31f0310c32.1.1.1.1.1.1.1.2
0x5a4942c32343238323c324032443248324c32,24282<2@2D2H2L2
0x5a4a450325432743294329c32a032a432a832P2T2t2.2.2.2.2.2
0x5a4b4ac32b032b432b832bc32d832f8320033.2.2.2.2.2.2.2.3
0x5a4c4043308330c331033143318331c332033.3.3.3.3.3.3.3 3
⋯11 more rows
Image list icon size import 0x5a658–0x5a7e8
⋯12 more rows
0x5a718c838da3888399d39f63b1f3c803c213d.8.8.9.9.;.<.<!=
0x5a728803d843d883d8c3d903d943dd63d1c3e.=.=.=.=.=.=.=.>
0x5a738203e243e283e2c3e303e8e3eaf3eb33e >$>(>,>0>.>.>.>
0x5a748b73ebb3ebf3ec33e153f000000100100.>.>.>.>.?......
⋯10 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.