Benign Download

Backdoor.Win32.Snowdoor.26

Image list icon size importExecute shell command (ShellExecuteA)
SHA-256ede0c0342d1674ddc06cdde5d733992878a77d8a3a15a5d41e7be074b2fc8d40
MaleculeH₂(PoU)

Evidence

Query/set system parameters (string) 0x8cf82–0x8d022
0x8cf82000053686f774f776e6564506f707570..ShowOwnedPopup
0x8cf927300000053686f775363726f6c6c4261s...ShowScrollBa
0x8cfa27200000053686f7757696e646f770000r...ShowWindow..
0x8cfb253797374656d506172616d6574657273SystemParameters
0x8cfc2496e666f41000000547261636b506f70InfoA...TrackPop
0x8cfd275704d656e7500005472616e736c6174upMenu..Translat
⋯5 more rows
Image list icon size import 0x925b0–0x92770
⋯17 more rows
0x926c000000000000000000000000000000000................
0x926d000000000000000000000000000000000................
0x926e000000000000000000000000000000000................
0x926f000000000000000000000000000000000................
0x9270000000000000000000000000000000000................
⋯7 more rows
Execute shell command (ShellExecuteA) 0x928c4–0x92984
⋯3 more rows
0x928f400000000000000000000000000000000................
0x9290400000000000000000000000000000000................
0x9291400000000000000000000000000000000................
⋯7 more rows
Query/set system parameters (symbol) 0x92ca8–0x92e98
⋯20 more rows
0x92de800000000000000000000000000000000................
0x92df800000000000000000000000000000000................
0x92e0800000000000000000000000000000000................
⋯9 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.