Benign Download

Worm.Win32.Agent.ho

Image list icon size importExecute shell command (ShellExecuteA)

SHA-256fe3ed8359b65539cc3c3a53e61e7e4f0437079e54c8097f7f4f4c46b58593e31

Evidence

Query/set system parameters (string) 0x55244–0x552e4

0x552446765000000005472616e736c6174654dge....TranslateM
0x552544449537973416363656c000000005472DISysAccel....Tr
0x5526461636b506f7075704d656e7500000000ackPopupMenu....
0x5527453797374656d506172616d6574657273SystemParameters
0x55284496e666f4100000053686f7757696e64InfoA...ShowWind
0x552946f770000000053686f775363726f6c6cow....ShowScroll
⋯5 more rows

Query/set system parameters (symbol) 0x57468–0x57548

0x57468c035da35df35b13612371f373a374037.5.5.5.6.7.7:7@7
0x574785437593739385e386b3876389738ad38T7Y798^8k8v8.8.8
0x57488c538ca38ff380e391b39263939394639.8.8.8.9.9&999F9
0x574988e399339ad39db39e739f339fd39033a.9.9.9.9.9.9.9.:
0x574a80d3a183a223a2c3a3e3a533a5f3a673a.:.:":,:>:S:_:g:
⋯10 more rows

Execute shell command (ShellExecuteA) 0x5764c–0x5781c

⋯13 more rows
0x5771c4c3c503c543c583c5c3c683c783c843cL<P<T<X<\<h<x<.<
0x5772c883c903c943c983c9c3ca03ca43ca83c.<.<.<.<.<.<.<.<
0x5773cac3cb03cb43cb83cbc3cc63cca3cdc3c.<.<.<.<.<.<.<.<
0x5774ced3cf13c293d2d3d313d493d583d5c3d.<.<)=-=1=I=X=\=
0x5775c643d683d783d803d843d883d8c3d903dd=h=x=.=.=.=.=.=
0x5776c943d983d9c3da03da43da83dac3db03d.=.=.=.=.=.=.=.=
0x5777cbe3ddc3df73dfb3d0c3e213e443e503e.=.=.=.=.>!>D>P>
0x5778c543e643e6c3e703e743e783e7c3e803eT>d>l>p>t>x>|>.>
0x5779c843e883e8c3e903e943e983e9c3ea03e.>.>.>.>.>.>.>.>
0x577aca43ea83eac3eb03eb43eb83ebc3ec03e.>.>.>.>.>.>.>.>
⋯7 more rows