Benign Download

Trojan-Downloader.Win32.Delf.hto

CreateRemoteThread API referenceCreateRemoteThread API string
SHA-256d396530f9c111e41577d43b31f29e71c969ad775f0be3a4c9b1063c0d32851c9
MaleculeO(Al)H(Po₂)

Evidence

CreateRemoteThread API reference 0x507c–0x514c
⋯3 more rows
0x50ac5452000064520000765200008a520000TR..dR..vR...R..
0x50bc9e520000b4520000000000006b65726e.R...R......kern
0x50cc656c33322e646c6c0000000047657443el32.dll....GetC
0x50dc757272656e7454687265616449640000urrentThreadId..
⋯7 more rows
CreateRemoteThread API string 0x5260–0x5330
⋯3 more rows
0x5290757272656e7450726f63657373000000urrentProcess...
0x52a043726561746552656d6f746554687265CreateRemoteThre
0x52b0616400000000436c6f736548616e646cad....CloseHandl
0x52c065000000000000000000000000000000e...............
⋯7 more rows
IsDebuggerPresent API name in PE strings 0xf57e–0xf64e
⋯3 more rows
0xf5ae65726d696e61746550726f6365737300erminateProcess.
0xf5be4973446562756767657250726573656eIsDebuggerPresen
0xf5ce74004f70656e50726f63657373005265t.OpenProcess.Re
0xf5de616446696c6500577269746546696c65adFile.WriteFile
⋯7 more rows
OllyDbg window-class marker 0x10ae4–0x10ba4
⋯3 more rows
0x10b145241434b494e472047524f55503d2d00RACKING GROUP=-.
0x10b244f6c6c79446267005452573230303000OllyDbg.TRW2000.
0x10b3400000000000000000000000000000000................
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.