Benign Download

Backdoor.Win32.Hupigon.dijx

Embedded PE binary at file offset 0x180edc (~102400 bytes)Image list icon size import

SHA-256e93cb67c0708b5ef95b9ea72e9af929234c9e4c9709de99c3276c872cec19fc8

Evidence

Query/set system parameters (string) 0x17e08a–0x17e12a

0x17e08a6765000000005472616e736c6174654dge....TranslateM
0x17e09a4449537973416363656c000000005472DISysAccel....Tr
0x17e0aa61636b506f7075704d656e7500000000ackPopupMenu....
0x17e0ba53797374656d506172616d6574657273SystemParameters
0x17e0ca496e666f4100000053686f7757696e64InfoA...ShowWind
0x17e0da6f770000000053686f775363726f6c6cow....ShowScroll
⋯5 more rows

Embedded PE binary at file offset 0x180edc (~102400 bytes) 0x180e9c–0x180f6c

⋯3 more rows
0x180ecc410049004e00490043004f004e000701A.I.N.I.C.O.N...
0x180edc4d5a4b45524e454c33322e444c4c0000MZKERNEL32.DLL..
0x180eec4c6f61644c6962726172794100000000LoadLibraryA....
0x180efc47657450726f63416464726573730000GetProcAddress..
⋯7 more rows

Query/set system parameters (symbol) 0x18265c–0x18274c

0x18265c3a50f22bdccba0d0ffced7c96706c964:P.+........g..d
0x18266cec36d7cd2e138abdb0aaa7a1299d4aa0.6..........).J.
0x18267c346e1f3a6d5daaa2b2ed55296166c2f44n.:m]....U)af..
0x18268c32ac5e8d937dde8dbab956830e49f3fb2.^..}....V..I..
0x18269cd07e553ade1dd205e8f834de1d893512.~U:......4...5.
⋯11 more rows

Execute shell command (ShellExecuteA) 0x1827c0–0x182ab0

⋯30 more rows
0x1829a06c482217b3ef2408f804d6a05bf96473lH"...$.....[.ds
0x1829b005a34da9fe0ede0d0d8ef92b977bc92c..M........+.{.,
0x1829c01d3743b01ed70e3a18f09fd408fdc467.7C....:.......g
0x1829d08404838f225333b789bb1c05b04bf3c0...."S3......K..
⋯4 more rows
0x182a20ada0cc1945acf54f4b70ad6aa80c2ac1....E..OKp.j..*.
0x182a30231e0d34ca57f6c8b497c616a3fa8cda#..4.W..........
0x182a4070fcf7e1d31363980578d196c02355cep.....c..x...#U.
0x182a50096d96e77314bea635a201f7ed37ed7e.m..s...5....7.~
⋯6 more rows