Benign Download

Constructor.Win32.Delf.bf

Embedded PE binary at file offset 0x81774 (~557056 bytes)Image list icon size import

SHA-256cbc6f0d0d438dfd69bf2c3939520db8bd8d101ff2d9b5d4aee929820015b35b3

Evidence

Query/set system parameters (string) 0x6c77e–0x6c81e

0x6c77e6765000000005472616e736c6174654dge....TranslateM
0x6c78e4449537973416363656c000000005472DISysAccel....Tr
0x6c79e61636b506f7075704d656e7500000000ackPopupMenu....
0x6c7ae53797374656d506172616d6574657273SystemParameters
0x6c7be496e666f4100000053686f7757696e64InfoA...ShowWind
0x6c7ce6f770000000053686f775363726f6c6cow....ShowScroll
⋯5 more rows

Query/set system parameters (symbol) 0x6e448–0x6e538

0x6e448bb3fc03fc63fcd3fd33fde3fe63fef3f.?.?.?.?.?.?.?.?
0x6e458fb3f000000c00000f800000001300930.?...........0.0
0x6e46812301e3023302c3035303e3047305030.0.0#0,050>0G0P0
0x6e478783081308a309030a130ac30b130ce30x0.0.0.0.0.0.0.0
0x6e488d630de30fe30473175319831b531fe31.0.0.0G1u1.1.1.1
⋯11 more rows

Execute shell command (ShellExecuteA) 0x6e628–0x6e7f8

⋯13 more rows
0x6e6f8c83bd53b043c3a3c543c893cc73cf93c.;.;.<:<T<.<.<.<
0x6e708373d693dab3dca3dd23dda3de23d193e7=i=.=.=.=.=.=.>
0x6e718273e2c3e373e3d3e423e4d3e533e583e'>,>7>=>B>M>S>X>
0x6e728633e693e6e3e793e7f3e843e8f3e953ec>i>n>y>.>.>.>.>
0x6e7389a3ea53eab3eb03ebb3ec13ec63ed13e.>.>.>.>.>.>.>.>
0x6e748d73edc3ee73eed3ef23efd3e033f083f.>.>.>.>.>.>.?.?
0x6e758133f193f1e3f293f2f3f343f3f3f453f.?.?.?)?/?4???E?
0x6e7684a3f553f5b3f603f6b3f713f763f813fJ?U?[?`?k?q?v?.?
0x6e778873f8c3f973f9d3fa23fad3fb33fb83f.?.?.?.?.?.?.?.?
0x6e788c33fc93fce3fd93fdf3fe43fef3ff53f.?.?.?.?.?.?.?.?
⋯7 more rows

Embedded PE binary at file offset 0x81774 (~557056 bytes) 0x81734–0x81804

⋯3 more rows
0x817646e7374730000ee556e69743100000000nsts...Unit1....
0x817744d5a50000200000004000f00ffff0000MZP.............
0x81784b80000000000000040001a0000000000........@.......
0x8179400000000000000000000000000000000................
⋯7 more rows