Benign Download

Backdoor.Win32.Hupigon.fyrs

Embedded PE binary at file offset 0x9cfcc (~63540 bytes)Image list icon size import

SHA-256d8bfe796a15f01ed09efcdfeb9cf648f6213b2b3e0296c6e446237a0ece9b4cd

Evidence

Embedded PE binary at file offset 0x9cfcc (~63540 bytes) 0x9cf8c–0x9d05c

⋯3 more rows
0x9cfbc1c8a4800308a4800616978696172616e..H.0.H.aixiaran
0x9cfcc4d5a90000300000004000000ffff0000MZ..............
0x9cfdcb8000000000000004000000000000000........@.......
0x9cfec00000000000000000000000000000000................
⋯7 more rows

Query/set system parameters (string) 0xa2120–0xa21c0

0xa21206765000000005472616e736c6174654dge....TranslateM
0xa21304449537973416363656c000000005472DISysAccel....Tr
0xa214061636b506f7075704d656e7500000000ackPopupMenu....
0xa215053797374656d506172616d6574657273SystemParameters
0xa2160496e666f4100000053686f7757696e64InfoA...ShowWind
0xa21706f770000000053686f775363726f6c6cow....ShowScroll
⋯5 more rows

Query/set system parameters (symbol) 0xa9620–0xa9710

0xa96206900660074002b000500430074007200i.f.t.+...C.t.r.
0xa96306c002b00040041006c0074002b002000l.+...A.l.t.+. .
0xa964043006c006900700062006f0061007200C.l.i.p.b.o.a.r.
0xa96506400200064006f006500730020006e00d. .d.o.e.s. .n.
0xa96606f007400200073007500700070006f00o.t. .s.u.p.p.o.
⋯11 more rows

Execute shell command (ShellExecuteA) 0xa9814–0xa99e4

⋯13 more rows
0xa98e420004d00650074006100660069006c00 .M.e.t.a.f.i.l.
0xa98f4650073000500490063006f006e007300e.s...I.c.o.n.s.
0xa990407004200690074006d00610070007300..B.i.t.m.a.p.s.
0xa991407005700610072006e0069006e006700..W.a.r.n.i.n.g.
0xa992405004500720072006f0072000b004900..E.r.r.o.r...I.
0xa99346e0066006f0072006d00610074006900n.f.o.r.m.a.t.i.
0xa99446f006e00070043006f006e0066006900o.n...C.o.n.f.i.
0xa995472006d00040026005900650073000300r.m...&.Y.e.s...
0xa996426004e006f0002004f004b0006004300&.N.o...O.K...C.
0xa997461006e00630065006c00050026004800a.n.c.e.l...&.H.
⋯7 more rows