e9435ca9d9e90dda4e4871a7ae71ae4b1e565aed8d35e1b6c18b3b0ea814b328

Sharing

Copy URL Twitter E-mail

General

Target

e9435ca9d9e90dda4e4871a7ae71ae4b1e565aed8d35e1b6c18b3b0ea814b328
Size

83KB
MD5

6fcee3d676b95bc971a46652a492ae6c
SHA1

13af04924dbee4c4671d4b0a5ffdd03d1166aacc
SHA256

e9435ca9d9e90dda4e4871a7ae71ae4b1e565aed8d35e1b6c18b3b0ea814b328
SHA512

0576dd7485ea78954aba6b11f3d4e6178a2c5ded33ce927d6351bca964576cc8e6567bd4a61d7943d3c6d98327a35b5c7b815a73f89d2bb94fc464fa90f64247
SSDEEP

1536:rkz0QbEFoH6rCrs6h4luK5uv4Itgc8QoKlWAKCxiMh8FDOIZBReVa5cCs7:gz0AEFnHk4luK5uv4It8s9KDMhoD0ay7

Score

N/A

Malware Config

Signatures

Files

e9435ca9d9e90dda4e4871a7ae71ae4b1e565aed8d35e1b6c18b3b0ea814b328
.exe windows x86

c4f4ab0897e167d4c5d2ba119303219d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_BYTES_REVERSED_HI

Imports

rtl120.bpl

@System@initialization$qqrv
@System@Finalization$qqrv
@System@RegisterModule$qqrp17System@TLibModule
@System@@UStrEqual$qqrv
@System@@UStrCat3$qqrr20System@UnicodeStringx20System@UnicodeStringt2
@System@@UStrToPWChar$qqrx20System@UnicodeString
@System@@UStrAsg$qqrr20System@UnicodeStringx20System@UnicodeString
@System@@UStrArrayClr$qqrpvi
@System@@UStrClr$qqrpv
@System@@UStrAddRef$qqrpv
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%
@System@@LStrFromPWChar$qqrr27System@%AnsiStringT$us$i0$%pbus
@System@@LStrClr$qqrpv
@System@@Halt0$qqrv
@System@@StartExe$qqrp23System@PackageInfoTablep17System@TLibModule
@System@@HandleFinally$qqrv
@System@ParamStr$qqri
@Sysutils@initialization$qqrv
@Sysutils@Finalization$qqrv
@Sysutils@ExtractFileDir$qqrx20System@UnicodeString
@Sysutils@StrToInt64Def$qqrx20System@UnicodeStringxj
@Sysutils@LowerCase$qqrx20System@UnicodeString
@Classes@initialization$qqrv
@Classes@Finalization$qqrv
@Typinfo@initialization$qqrv
@Typinfo@Finalization$qqrv
@Variants@initialization$qqrv
@Variants@Finalization$qqrv
@Varutils@initialization$qqrv
@Varutils@Finalization$qqrv

kernel32

GetModuleHandleW
SetFileAttributesW
LoadLibraryW
GetProcAddress
GetFileAttributesW
GetCurrentProcess
FreeLibrary
CloseHandle

user32

SendMessageW

advapi32

RegSaveKeyW
RegReplaceKeyW
RegCreateKeyExW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges

maincontrols.bpl

@Encodedecode@UrlDecode$qqrx20System@UnicodeString

tubase.bpl

@Tuneupwow64@initialization$qqrv
@Tuneupwow64@Finalization$qqrv
@Tuneupwow64@IsCurrentProcessWow64$qqrv

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 36B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 292B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 70KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c4f4ab0897e167d4c5d2ba119303219d

Headers

File Characteristics

Imports

rtl120.bpl

kernel32

user32

advapi32

maincontrols.bpl

tubase.bpl

Sections

.text Size: 1KB - Virtual size: 1KB

.itext Size: 1KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 28B

.bss Size: - Virtual size: 36B

.idata Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 292B

.rsrc Size: 70KB - Virtual size: 72KB

.text
Size: 1KB - Virtual size: 1KB

.itext
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 28B

.bss
Size: - Virtual size: 36B

.idata
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 292B

.rsrc
Size: 70KB - Virtual size: 72KB