Benign Download

Trojan-Downloader.Win32.Delf.cuk

CreateRemoteThread API referenceCreateRemoteThread API string

SHA-256f061708d95d74325752c8c2400eb9da44d24447258e0707ec8f6631f698aea34

Evidence

CreateRemoteThread API string 0x4f7e6–0x4f8b6

⋯3 more rows
0x4f81643726561746554687265616400000000CreateThread....
0x4f82643726561746552656d6f746554687265CreateRemoteThre
0x4f8366164000000004372656174654d757465ad....CreateMute
0x4f84678410000000043726561746546696c65xA....CreateFile
⋯7 more rows

Query/set system parameters (string) 0x4fd1a–0x4fdba

0x4fd1a6765000000005472616e736c6174654dge....TranslateM
0x4fd2a4449537973416363656c000000005472DISysAccel....Tr
0x4fd3a61636b506f7075704d656e7500000000ackPopupMenu....
0x4fd4a53797374656d506172616d6574657273SystemParameters
0x4fd5a496e666f4100000053686f7757696e64InfoA...ShowWind
0x4fd6a6f770000000053686f775363726f6c6cow....ShowScroll
⋯5 more rows

CreateRemoteThread API reference 0x522e8–0x523b8

⋯3 more rows
0x523184e30523056305a30723080308430a030N0R0V0Z0r0.0.0.0
0x52328a830ac30b030b430b830bc30c030c430.0.0.0.0.0.0.0.0
0x52338c830cc30d030d430d830dc30e030e430.0.0.0.0.0.0.0.0
0x52348e830ec30f030f4300831283130313431.0.0.0.0.1(10141
⋯7 more rows

Query/set system parameters (symbol) 0x5242c–0x5250c

0x5242c78347c348034843488348c349c34ac34x4|4.4.4.4.4.4.4
0x5243cb034c034df340035203528352c353035.4.4.4.5 5(5,505
0x5244c343538353c354035443548354c3550354585<5@5D5H5L5P5
0x5245c543558355c3560356435683580359035T5X5\5`5d5h5.5.5
0x5246c9c35a035a835ac35b035b435b835bc35.5.5.5.5.5.5.5.5
⋯10 more rows

Image list icon size import 0x525f8–0x52788

⋯12 more rows
0x526b85e39653996399d391e3a7c3ab73ac73a^9e9.9.9.:|:.:.:
0x526c8e73a3d3ca03ca73c053d0c3d233d0a3f.:=<.<.<.=.=#=.?
0x526d81e3f363f3d3f000000600100bc000000.?6?=?...`......
0x526e80b302c303b305230123119319c31a831.0,0;0R0.1.1.1.1
⋯10 more rows