Benign Download

Backdoor.Win32.Hupigon.fjcr

Embedded PE binary at file offset 0x9cbd4 (~64556 bytes)Image list icon size import

SHA-256ce7ddec56dafb580a2b406b487c72c21c76f70bd528570ff92ae95c3d034dc24

Evidence

Embedded PE binary at file offset 0x9cbd4 (~64556 bytes) 0x9cb94–0x9cc64

⋯3 more rows
0x9cbc4d078480010794800616978696172616e.xH..yH.aixiaran
0x9cbd44d5a90000300000004000000ffff0000MZ..............
0x9cbe4b8000000000000004000000000000000........@.......
0x9cbf400000000000000000000000000000000................
⋯7 more rows

Query/set system parameters (string) 0xa2572–0xa2612

0xa25726765000000005472616e736c6174654dge....TranslateM
0xa25824449537973416363656c000000005472DISysAccel....Tr
0xa259261636b506f7075704d656e7500000000ackPopupMenu....
0xa25a253797374656d506172616d6574657273SystemParameters
0xa25b2496e666f4100000053686f7757696e64InfoA...ShowWind
0xa25c26f770000000053686f775363726f6c6cow....ShowScroll
⋯5 more rows

Query/set system parameters (symbol) 0xa4630–0xa4720

0xa4630540045004d0050004c00410054004500T.E.M.P.L.A.T.E.
0xa464006004400560043004c0041004c000b00..D.V.C.L.A.L...
0xa46505000410043004b004100470045004900P.A.C.K.A.G.E.I.
0xa46604e0046004f001400540044004f005500N.F.O...T.D.O.U.
0xa467042004c0045004e0049004e0054004800B.L.E.N.I.N.T.H.
⋯11 more rows

Execute shell command (ShellExecuteA) 0xa4824–0xa49f4

⋯13 more rows
0xa48f4ffe003ffffc001ffffc001ffffffffff................
0xa4904ffffffffffffffff0000000028000000............(...
0xa491420000000400000000100010000000000 ...@...........
0xa492480000000000000000000000002000000................
0xa49340000000000000000ffffff0000000000................
0xa49440000000000000000001ff00000003000..............0.
0xa495400ffb0000001b00007fdb00007fdb000................
0xa496407fdb00007fdb00007fdb000073db000.............=..
0xa497406ddb00006dd800005bd800005bc0000................
0xa4984037c0000430000006600000076000000.|..C...f...v...
⋯7 more rows