Benign Download

Virus.Win32.HLLC.Godev

Embedded PE binary at file offset 0x6fc34 (~740300 bytes)Image list icon size import

SHA-256faa89bbb5b148a38c368abbe1b0aee3509b9fc782afafde371f17d2d2dd110c4

Evidence

Query/set system parameters (string) 0x677ec–0x6788c

0x677ec6765000000005472616e736c6174654dge....TranslateM
0x677fc4449537973416363656c000000005472DISysAccel....Tr
0x6780c61636b506f7075704d656e7500000000ackPopupMenu....
0x6781c53797374656d506172616d6574657273SystemParameters
0x6782c496e666f4100000053686f7757696e64InfoA...ShowWind
0x6783c6f770000000053686f775363726f6c6cow....ShowScroll
⋯5 more rows

Query/set system parameters (symbol) 0x68460–0x68540

0x684606973745f416464000000496d6167654cist_Add...ImageL
0x684706973745f476574496d616765436f756eist_GetImageCoun
0x6848074000000496d6167654c6973745f4465t...ImageList_De
0x684907374726f79000000496d6167654c6973stroy...ImageLis
0x684a0745f43726561746500007368656c6c33t_Create..shell3
⋯10 more rows

Execute shell command (ShellExecuteA) 0x68638–0x68818

⋯14 more rows
0x6871800000000000000000000000000000000................
0x6872800000000000000000000000000000000................
0x6873800000000000000000000000000000000................
0x6874800000000000000000000000000000000................
0x6875800000000000000000000000000000000................
0x6876800000000000000000000000000000000................
0x6877800000000000000000000000000000000................
0x6878800000000000000000000000000000000................
0x6879800000000000000000000000000000000................
0x687a800000000000000000000000000000000................
⋯7 more rows

Embedded PE binary at file offset 0x6fc34 (~740300 bytes) 0x6fbf4–0x6fcc4

⋯3 more rows
0x6fc244d00410049004e00490043004f004e00M.A.I.N.I.C.O.N.
0x6fc344d5a50000200000004000f00ffff0000MZP.............
0x6fc44b80000000000000040001a0000000000........@.......
0x6fc5400000000000000000000000000000000................
⋯7 more rows