Benign Download

Trojan-Spy.Win32.Delf.cfv

Image list icon size importExecute shell command (ShellExecuteA)

SHA-256e19538e0dfffcb7671b7ad9eaf5240dfc28f1f8ecc3b16778001f8d458b69c55

Evidence

Query/set system parameters (string) 0xadfa6–0xae046

0xadfa66765000000005472616e736c6174654dge....TranslateM
0xadfb64449537973416363656c000000005472DISysAccel....Tr
0xadfc661636b506f7075704d656e7500000000ackPopupMenu....
0xadfd653797374656d506172616d6574657273SystemParameters
0xadfe6496e666f4100000053686f7757696e64InfoA...ShowWind
0xadff66f770000000053686f775363726f6c6cow....ShowScroll
⋯5 more rows

Query/set system parameters (symbol) 0xb0518–0xb0608

0xb05181f3f383fb83fbc3fc03fc43fc83fcc3f.?8?.?.?.?.?.?.?
0xb0528d03fd43fd83fdc3fe03fe43fe83fec3f.?.?.?.?.?.?.?.?
0xb0538f03ff43ff83ffc3f0030010024010000.?.?.?.?.0..$...
0xb05480030043008300c30203047305930b630.0.0.0.0 0G0Y0.0
0xb0558d130ed3008312831bd31c131c531c931.0.0.1(1.1.1.1.1
⋯11 more rows

Execute shell command (ShellExecuteA) 0xb0708–0xb0908

⋯15 more rows
0xb07f8e83a013b103b283b803b913bd43be63b.:.;.;(;.;.;.;.;
0xb0808ec3b083c203c403c583c7d3c843ca43c.;.< <@<X<}<.<.<
0xb0818ac3cb03cb43cb83cbc3cc03cc43cc83c.<.<.<.<.<.<.<.<
0xb0828cc3ce03c003d083d0c3d103d143d183d.<.<.=.=.=.=.=.=
0xb08381c3d203d243d283d403d603d683d6c3d.= =$=(=@=`=h=l=
0xb0848703d743d783d7c3d803d843d883d9c3dp=t=x=|=.=.=.=.=
0xb0858bc3dc43dc83dcc3dd03dd43dd83ddc3d.=.=.=.=.=.=.=.=
0xb0868e03de43df43d143e1c3e203e243e283e.=.=.=.>.> >$>(>
0xb08782c3e303e343e383e3c3e4c3e6c3e743e,>0>4>8><>L>l>t>
0xb0888783e7c3e803e843e883e8c3e903e943ex>|>.>.>.>.>.>.>
0xb0898a43ec43ecc3ed03ed43ed83edc3ee03e.>.>.>.>.>.>.>.>
⋯7 more rows