Benign Download

Backdoor.Win32.Delf.qa

Image list icon size importExecute shell command (ShellExecuteA)

SHA-256f58f554eba8df1633bfe035d31e41ce0c117b321dad05e1a148a0856afccc6c9

Evidence

Query/set system parameters (string) 0xa4da4–0xa4e44

0xa4da46765000000005472616e736c6174654dge....TranslateM
0xa4db44449537973416363656c000000005472DISysAccel....Tr
0xa4dc461636b506f7075704d656e7500000000ackPopupMenu....
0xa4dd453797374656d506172616d6574657273SystemParameters
0xa4de4496e666f4100000053686f7757696e64InfoA...ShowWind
0xa4df46f770000000053686f775363726f6c6cow....ShowScroll
⋯5 more rows

Query/set system parameters (symbol) 0xa7590–0xa7680

0xa75908d30913095309930a430b83019313631.0.0.0.0.0.0.161
0xa75a0533170318f311032483277329232a832S1p1.1.2H2w2.2.2
0xa75b00833403357337033b833d5330d342634[email protected]&4
0xa75c03d349034c034f5341135153519351d35=4.4.4.4.5.5.5.5
0xa75d02135253529352d353135353539353d35!5%5)5-5155595=5
⋯11 more rows

Execute shell command (ShellExecuteA) 0xa7780–0xa7970

⋯15 more rows
0xa78705c3c603c643c683c6c3c703c743c843c\<`<d<h<l<p<t<.<
0xa7880a43cac3cb03cb43cb83cbc3cc03cc43c.<.<.<.<.<.<.<.<
0xa7890c83ccc3cdc3cfc3c043d083d0c3d103d.<.<.<.<.=.=.=.=
0xa78a0143d183d1c3d203d243d343d543d5c3d.=.=.= =$=4=T=\=
0xa78b0603d643d683d6c3d703d743d783d7c3d`=d=h=l=p=t=x=|=
0xa78c08c3dac3db43db83dbc3dc03dc43dc83d.=.=.=.=.=.=.=.=
0xa78d0cc3dd03dd43de83d083e103e143e183e.=.=.=.=.>.>.>.>
0xa78e01c3e203e243e283e2c3e303e443e643e.> >$>(>,>0>D>d>
0xa78f06c3e703e743e783e7c3e803e843e883el>p>t>x>|>.>.>.>
0xa79008c3e9c3ebc3ec43ec83ecc3ed03ed43e.>.>.>.>.>.>.>.>
⋯7 more rows