Benign Download

Trojan-Downloader.Win32.Banload.hqu

Image list icon size importExecute shell command (ShellExecuteA)

SHA-256d8c3b3882f75c3ee7a05509841d796d57cd400dcda0322f40aa7a2df672dc662

Evidence

Query/set system parameters (string) 0x5618a–0x5622a

0x5618a6765000000005472616e736c6174654dge....TranslateM
0x5619a4449537973416363656c000000005472DISysAccel....Tr
0x561aa61636b506f7075704d656e7500000000ackPopupMenu....
0x561ba53797374656d506172616d6574657273SystemParameters
0x561ca496e666f4100000053686f7757696e64InfoA...ShowWind
0x561da6f770000000053686f775363726f6c6cow....ShowScroll
⋯5 more rows

Query/set system parameters (symbol) 0x58400–0x584f0

0x58400bb3ed33eeb3e5a3f713f843f963f0000.>.>.>Z?q?.?.?..
0x584100000010024010000143029303e304330....$....0)0>0C0
0x58420503070308a308f306131c231cf31ea31P0p0.0.0a1.1.1.1
0x58430f03104320932e9320e331b3326334733.1.2.2.2.3.3&3G3
0x584405d3375337a33af33be33cb33d633e933]3u3z3.3.3.3.3.3
⋯11 more rows

Execute shell command (ShellExecuteA) 0x585d0–0x58790

⋯12 more rows
0x58690e435e8350036203628362c3630363436.5.5.6 6(6,60646
0x586a038363c364036443648364c365036543686<6@6D6H6L6P6T6
0x586b05836643684368c369036943698369c36X6d6.6.6.6.6.6.6
0x586c0a036a436a836ac36bc36dc36e436e836.6.6.6.6.6.6.6.6
0x586d0ec36f036f436f836fc36003704371037.6.6.6.6.6.7.7.7
0x586e020372c37303738373c37403744374837 7,70787<7@7D7H7
0x586f04c375037543758375c37603764376e37L7P7T7X7\7`7d7n7
0x587007237843795379937d137d537d937f137r7.7.7.7.7.7.7.7
0x58710003804380c381038203828382c383038.8.8.8.8 8(8,808
0x58720343838383c384038443848384c3850384888<8@8D8H8L8P8
⋯7 more rows