Benign Download

Trojan-Downloader.Win32.Agent.bayf

Image list icon size importExecute shell command (ShellExecuteA)

SHA-256d63924b088963ef5218c3c18ed15848b7b82d58d05d8a7475d98ebc2bd95724b

Evidence

Query/set system parameters (string) 0x4f608–0x4f6a8

0x4f6086765000000005472616e736c6174654dge....TranslateM
0x4f6184449537973416363656c000000005472DISysAccel....Tr
0x4f62861636b506f7075704d656e7500000000ackPopupMenu....
0x4f63853797374656d506172616d6574657273SystemParameters
0x4f648496e666f4100000053686f7757696e64InfoA...ShowWind
0x4f6586f770000000053686f775363726f6c6cow....ShowScroll
⋯5 more rows

Query/set system parameters (symbol) 0x51418–0x514f8

0x51418a73ead3eb73ebd3ec73ed23edc3ee73e.>.>.>.>.>.>.>.>
0x51428f13efc3e063f113f1b3f263f303f3a3f.>.>.?.?.?&?0?:?
0x51438443f4e3f583f623f6c3f763f803f8a3fD?N?X?b?l?v?.?.?
0x514489c3fb33fbf3fc73fd13fdc3fe43fe93f.?.?.?.?.?.?.?.?
0x5145800d00000480200000f302e3036303e30....H....0.060>0
⋯10 more rows

Execute shell command (ShellExecuteA) 0x515e8–0x517a8

⋯12 more rows
0x516a806301d304a30d130e030013110312731.0.0J0.0.0.1.1'1
0x516b836314d315c31733182319931a831bf3161M1\1s1.1.1.1.1
0x516c8ce31e231f1310232343243325a32d132.1.1.1.242C2Z2.2
0x516d8df32ee32053374358f389d383c397439.2.2.3t5.8.8<9t9
0x516e8a339be39d439343a6c3a833a9c3ae43a.9.9.94:l:.:.:.:
0x516f8013b393b523b693bbc3bec3b213c3d3c.;9;R;i;.;.;!<=<
0x51708413c453c493c4d3c513c553c593c5d3cA<E<I<M<Q<U<Y<]<
0x51718613c653c693c6d3c713c753c793c7d3ca<e<i<m<q<u<y<}<
0x51728813c853c893c8d3c913ca33cbb3cd13e.<.<.<.<.<.<.<.>
0x51738d53ed93edd3ee13ee53ee93eed3ef13e.>.>.>.>.>.>.>.>
⋯7 more rows