Benign Download

dfa2ab0714c9f234b63fd1295ce468bd247465701a90b8a9ab9eb3d6d032d258.exe

Dynamic library loading via LoadLibraryW

SHA-256dfa2ab0714c9f234b63fd1295ce468bd247465701a90b8a9ab9eb3d6d032d258

MaleculeH(Ds)

Evidence

.dll extension reference 0x76e280–0x76e2b0

0x76e2806e747279000000006b00650072006e00ntry....k.e.r.n.
0x76e29065006c00330032002e0064006c006c00e.l.3.2...d.l.l.
0x76e2a000000000460073007700770061002e00....F.s.w.w.a...
0x76e2b064006c00                        d.l.            

Dynamic library loading via LoadLibraryW 0x76eff0–0x76f090

0x76eff00000000000000000f02e770030000000..........w.0...
0x76f0000000000000000000c0ba790084000000..........y.....
0x76f010000000000000000048bb7900a4040000........H.y.....
0x76f02000000000000000000000000000000000................
0x76f03000000000000064004c006a0079007700......d.L.j.y.w.
0x76f0407800720077006f0061006f0000000000x.r.w.o.a.o.....
0x76f05065004d00610075007500620000001000e.M.a.u.u.b.....
⋯4 more rows

PNG image data in PE resources 0x77091b–0x77094b

0x77091b003a01000089504e470d0a1a0a000000.:....PNG.......
0x77092b0d494844520000010000000100080600.IHDR...........
0x77093b00005c72a86600000009704859730000..\r.f....pHYs..
0x77094b0ec30000                        ....            

Contains version information 0x79953e–0x79956e

0x79953e68040000090000000000a40434000000h...........4...
0x79954e560053005f0056004500520053004900V.S._.V.E.R.S.I.
0x79955e4f004e005f0049004e0046004f000000O.N._.I.N.F.O...
0x79956e0000bd04effe000001000100090081  ............... 

PE FileVersion metadata field 0x7997ba–0x79982a

0x7997ba6e00630065000000000036000b000100n.c.e.....6.....
0x7997ca460069006c0065005600650072007300F.i.l.e.V.e.r.s.
0x7997da69006f006e000000000039002e003100i.o.n.....9...1.
0x7997ea2e00320032002e003800390037000000..2.2...8.9.7...
0x7997fa00003a000d00010049006e0074006500..:.....I.n.t.e.
⋯3 more rows