Benign Download

Trojan-GameThief.Win32.OnLineGames.dai

Embedded PE binary at file offset 0x4708 (~43770 bytes)Execute shell command (ShellExecuteA)
SHA-256cf6f7d2e0c8a936b3c58241c071631d9a280dfbb3056b491a75397c317ecd915
MaleculeO(Er)H(Po)

Evidence

Embedded PE binary at file offset 0x4708 (~43770 bytes) 0x46c8–0x4798
⋯3 more rows
0x46f84b0041004700450049004e0046004f00K.A.G.E.I.N.F.O.
0x47084d5a50000200000004000f00ffff0000MZP.............
0x4718b80000000000000040001a0000000000........@.......
0x472800000000000000000000000000000000................
⋯7 more rows
Execute shell command (ShellExecuteA) 0x70a8–0x7238
⋯15 more rows
0x71985dc38bc08b151ca040008910a31ca040].......@......@
0x71a800c38bc0558bec518945fc33d2556808....U..Q.E.3.Uh.
0x71b837400064ff326489228b45fc8b4004e8[email protected].".E..@..
0x71c874ffffff33c05a5959648910680f3740t...3.ZYYd..h.7@
⋯7 more rows
Detour-style InstallHook helper name 0xdf0c–0xdfcc
⋯3 more rows
0xdf3c50d0000001000000446c6c2e646c6c00P.......Dll.dll.
0xdf4c496e7374616c6c486f6f6b00496e7374InstallHook.Inst
0xdf5c616c6c486f6f6b310000000000000000allHook1........
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.