Static task
static1
Behavioral task
behavioral1
Sample
5b5ee3c51dbff0c772f15f8e74988798dbb3cb85d039744e4509e886b5788f4f.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
5b5ee3c51dbff0c772f15f8e74988798dbb3cb85d039744e4509e886b5788f4f.dll
Resource
win10v2004-20230915-en
General
-
Target
5b5ee3c51dbff0c772f15f8e74988798dbb3cb85d039744e4509e886b5788f4f
-
Size
92KB
-
MD5
80d661feae076c60e53be2b2ceaed31f
-
SHA1
d0cceb679ac23b880134286e47415586e48e715f
-
SHA256
5b5ee3c51dbff0c772f15f8e74988798dbb3cb85d039744e4509e886b5788f4f
-
SHA512
733c06f0b9092d857244e2ab55ded643cd630ca6c41ce6211635f6ce3a1fcd0990460e83cd3e67037b734a9fc65759b8c31dbec6bbd6d124bfd6f7592022e01d
-
SSDEEP
1536:6IQE1kBhr4d33Y2BjRk3CUggTxbVtk/UubemcGzrt4:6PBh8loDgglVm/UubemZ54
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5b5ee3c51dbff0c772f15f8e74988798dbb3cb85d039744e4509e886b5788f4f
Files
-
5b5ee3c51dbff0c772f15f8e74988798dbb3cb85d039744e4509e886b5788f4f.dll windows:5 windows x86
51790d6bb0b9b6459b0ed7a141477f2d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Imports
rtl140.bpl
@System@initialization$qqrv
@System@Finalization$qqrv
@System@TInterfacedObject@_Release$qqsv
@System@TInterfacedObject@_AddRef$qqsv
@System@TInterfacedObject@QueryInterface$qqsrx5_GUIDpv
@System@TInterfacedObject@NewInstance$qqrv
@System@TInterfacedObject@BeforeDestruction$qqrv
@System@TInterfacedObject@AfterConstruction$qqrv
@System@@IntfAddRef$qqrx45System@%DelphiInterface$t17System@IInterface%
@System@@IntfCopy$qqrr45System@%DelphiInterface$t17System@IInterface%x45System@%DelphiInterface$t17System@IInterface%
@System@@IntfClear$qqrr45System@%DelphiInterface$t17System@IInterface%
@System@RegisterModule$qqrp17System@TLibModule
@System@@DynArrayAsg$qqrv
@System@@DynArrayClear$qqrrpvpv
@System@@DynArraySetLength$qqrv
@System@@DynArrayHigh$qqrv
@System@@DynArrayLength$qqrv
@System@@CopyRecord$qqrv
@System@@FinalizeArray$qqrpvt1ui
@System@@FinalizeRecord$qqrpvt1
@System@@InitializeRecord$qqrpvt1
@System@@UStrEqual$qqrv
@System@@UStrCat3$qqrr20System@UnicodeStringx20System@UnicodeStringt2
@System@@UStrToPWChar$qqrx20System@UnicodeString
@System@@UStrLAsg$qqrr20System@UnicodeStringx20System@UnicodeString
@System@@UStrAsg$qqrr20System@UnicodeStringx20System@UnicodeString
@System@@UStrArrayClr$qqrpvi
@System@@UStrClr$qqrpv
@System@@UStrAddRef$qqrpv
@System@@RunError$qqruc
@System@@Halt0$qqrv
@System@@StartLib$qqrv
@System@@TryFinallyExit$qqrv
@System@@DoneExcept$qqrv
@System@@RaiseExcept$qqrv
@System@@HandleFinally$qqrv
@System@@HandleOnException$qqrv
@System@@HandleAnyException$qqrv
@System@@BeforeDestruction$qqrp14System@TObjectzc
@System@@AfterConstruction$qqrp14System@TObject
@System@@ClassDestroy$qqrp14System@TObject
@System@@ClassCreate$qqrp17System@TMetaClasso
@System@TObject@Dispatch$qqrpv
@System@TObject@BeforeDestruction$qqrv
@System@TObject@AfterConstruction$qqrv
@System@TObject@DefaultHandler$qqrpv
@System@TObject@ToString$qqrv
@System@TObject@SafeCallException$qqrp14System@TObjectpv
@System@TObject@GetHashCode$qqrv
@System@TObject@Equals$qqrp14System@TObject
@System@TObject@Free$qqrv
@System@TObject@$bdtr$qqrv
@System@TObject@$bctr$qqrv
@System@TObject@FreeInstance$qqrv
@System@TObject@NewInstance$qqrv
@System@@FillChar$qqrpvib
@System@@AbstractError$qqrv
@System@ParamStr$qqri
@System@Move$qqrpxvpvi
@$xp$16System@TDateTime
@$xp$24System@TInterfacedObject
@System@TInterfacedObject@
@$xp$18System@IEnumerable
@$xp$17System@IInterface
@$xp$14System@TObject
@System@TObject@
@$xp$14System@Variant
@$xp$13System@string
@$xp$8Cardinal
@$xp$7Integer
@$xp$7Boolean
@Sysutils@initialization$qqrv
@Sysutils@Finalization$qqrv
@Sysutils@TEncoding@GetUTF8$qqrv
@Sysutils@TEncoding@GetString$qqrx25System@%DynamicArray$tuc%
@Sysutils@TEncoding@GetBytes$qqrx20System@UnicodeString
@Sysutils@TEncoding@$bcdtr$qqrv
@Sysutils@TLanguages@$bcdtr$qqrv
@Sysutils@Supports$qqrpx14System@TObjectrx5_GUIDpv
@Sysutils@TMultiReadExclusiveWriteSynchronizer@EndRead$qqrv
@Sysutils@TMultiReadExclusiveWriteSynchronizer@BeginRead$qqrv
@Sysutils@TMultiReadExclusiveWriteSynchronizer@EndWrite$qqrv
@Sysutils@TMultiReadExclusiveWriteSynchronizer@BeginWrite$qqrv
@Sysutils@TMultiReadExclusiveWriteSynchronizer@$bctr$qqrv
@Sysutils@GetLocaleFormatSettings$qqrir24Sysutils@TFormatSettings
@Sysutils@Exception@$bcdtr$qqrv
@Sysutils@Exception@$bcctr$qqrv
@Sysutils@Exception@ToString$qqrv
@Sysutils@Exception@RaisingException$qqrp25Sysutils@TExceptionRecord
@Sysutils@Exception@GetBaseException$qqrv
@Sysutils@Exception@$bdtr$qqrv
@Sysutils@Exception@$bctr$qqrp20System@TResStringRec
@Sysutils@Exception@$bctr$qqrx20System@UnicodeString
@Sysutils@OutOfMemoryError$qqrv
@Sysutils@FormatDateTime$qqrx20System@UnicodeString16System@TDateTimerx24Sysutils@TFormatSettings
@Sysutils@DateTimeToStr$qqrx16System@TDateTimerx24Sysutils@TFormatSettings
@Sysutils@Now$qqrv
@Sysutils@Format$qqrx20System@UnicodeStringpx14System@TVarRecxi
@Sysutils@ExtractFileName$qqrx20System@UnicodeString
@Sysutils@ChangeFileExt$qqrx20System@UnicodeStringt1
@Sysutils@IntToStr$qqrj
@Sysutils@SameText$qqrx20System@UnicodeStringt1
@Sysutils@TEncoding@$bcctr$qqrv
@$xp$45Sysutils@TMultiReadExclusiveWriteSynchronizer
@Sysutils@TMultiReadExclusiveWriteSynchronizer@
@$xp$24Sysutils@TFormatSettings
@Sysutils@EArgumentOutOfRangeException@
@$xp$18Sysutils@Exception
@Sysutils@Exception@
@$xp$15Sysutils@TBytes
@Sysutils@TLanguages@$bcctr$qqrv
@Rtlconsts@_SGenericDuplicateItem
@Rtlconsts@_SGenericItemNotFound
@Rtlconsts@_SArgumentOutOfRange
@Classes@initialization$qqrv
@Classes@Finalization$qqrv
@Classes@TThread@$bcdtr$qqrv
@Classes@TThread@$bcctr$qqrv
@Classes@TFileStream@$bctr$qqrx20System@UnicodeStringus
@Classes@TStringList@$bctr$qqrv
@Classes@TInterfacedPersistent@QueryInterface$qqsrx5_GUIDpv
@Classes@TInterfacedPersistent@AfterConstruction$qqrv
@Classes@TPersistent@DefineProperties$qqrp14Classes@TFiler
@Classes@TPersistent@AssignTo$qqrp19Classes@TPersistent
@Classes@TPersistent@Assign$qqrp19Classes@TPersistent
@Classes@TPersistent@$bdtr$qqrv
@Classes@TFileStream@
@$xp$19Classes@TStringList
@Classes@TStringList@
@$xp$29Classes@TInterfacedPersistent
@Classes@TInterfacedPersistent@
@Classes@EListError@
@Typinfo@initialization$qqrv
@Typinfo@Finalization$qqrv
@Variants@initialization$qqrv
@Variants@Finalization$qqrv
@Variants@@VarFromInt$qqrr8TVarDataxixzc
@Variants@@VarClr$qqrr8TVarData
@Varutils@initialization$qqrv
@Varutils@Finalization$qqrv
@Generics_defaults@_LookupVtableInfo$qqr42Generics_defaults@TDefaultGenericInterfacep17Typinfo@TTypeInfoi
@Generics_collections@InCircularRange$qqriii
@$xp$44Generics_collections@TCollectionNotification
@Generics_collections@TArray@
@Rtti@initialization$qqrv
@Rtti@Finalization$qqrv
@Syncobjs@initialization$qqrv
@Syncobjs@Finalization$qqrv
@Timespan@TTimeSpan@$bcctr$qqrv
@Timespan@TTimeSpan@$bcdtr$qqrv
@Varconv@initialization$qqrv
@Varconv@Finalization$qqrv
@Convutils@initialization$qqrv
@Convutils@Finalization$qqrv
@Varcmplx@initialization$qqrv
@Varcmplx@Finalization$qqrv
@Registry@initialization$qqrv
@Registry@Finalization$qqrv
@Inifiles@initialization$qqrv
@Inifiles@Finalization$qqrv
@Ioutils@initialization$qqrv
@Ioutils@Finalization$qqrv
@Ioutils@TPath@$bcctr$qqrv
@Ioutils@TPath@$bcdtr$qqrv
@Comobj@initialization$qqrv
@Comobj@Finalization$qqrv
@Uxtheme@initialization$qqrv
@Uxtheme@Finalization$qqrv
@Helpintfs@initialization$qqrv
@Helpintfs@Finalization$qqrv
@Multimon@initialization$qqrv
@Multimon@Finalization$qqrv
@Flatsb@initialization$qqrv
@Flatsb@Finalization$qqrv
kernel32
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
Sleep
WaitForSingleObject
UnmapViewOfFile
ReleaseMutex
OutputDebugStringW
OpenProcess
MapViewOfFile
GetVersionExW
GetLastError
GetExitCodeProcess
GetCurrentProcessId
FreeLibrary
CreateMutexW
CreateFileMappingW
CloseHandle
advapi32
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
baselib.bpl
@Fslib@initialization$qqrv
@Fslib@Finalization$qqrv
@Fslib@TDummyThread@$bctr$qqr42System@%DelphiInterface$t14Sysutils@TProc%o
@Fslib@GetVersionInfo$qqr20System@UnicodeStringt1t1
@Fslib@TDummyThread@
@Fslib@TStrComparerNoCase@
@Fslib@TStrComparerCase@
@Regularexpressions@initialization$qqrv
@Regularexpressions@Finalization$qqrv
@Superobject@ObjectFindClose$qqrr28Superobject@TSuperObjectIter
@Superobject@ObjectFindNext$qqrr28Superobject@TSuperObjectIter
@Superobject@ObjectFindFirst$qqrx52System@%DelphiInterface$t24Superobject@ISuperObject%r28Superobject@TSuperObjectIter
@Superobject@SO$qqrrx14System@Variant
@Superobject@SO$qqrpx14System@TVarRecxi
@Superobject@SO$qqrx20System@UnicodeString
@$xp$28Superobject@TSuperObjectIter
@$xp$24Superobject@ISuperObject
@Cfgvnt@initialization$qqrv
@Cfgvnt@Finalization$qqrv
@Sevenzip@initialization$qqrv
@Sevenzip@Finalization$qqrv
@Fsmui@initialization$qqrv
@Fsmui@Finalization$qqrv
@Fsoem@initialization$qqrv
@Fsoem@Finalization$qqrv
@Bmxcarddef@initialization$qqrv
@Bmxcarddef@Finalization$qqrv
@Fssocket@initialization$qqrv
@Fssocket@Finalization$qqrv
nativexml401.bpl
@Nativexml@initialization$qqrv
@Nativexml@Finalization$qqrv
@Sddebug@initialization$qqrv
@Sddebug@Finalization$qqrv
vcl140.bpl
@Graphics@initialization$qqrv
@Graphics@Finalization$qqrv
@Forms@initialization$qqrv
@Forms@Finalization$qqrv
@Actnlist@initialization$qqrv
@Actnlist@Finalization$qqrv
@Themes@initialization$qqrv
@Themes@Finalization$qqrv
@Controls@initialization$qqrv
@Controls@Finalization$qqrv
@Menus@initialization$qqrv
@Menus@Finalization$qqrv
@Dialogs@initialization$qqrv
@Dialogs@Finalization$qqrv
@Comctrls@initialization$qqrv
@Comctrls@Finalization$qqrv
@Graphutil@initialization$qqrv
@Graphutil@Finalization$qqrv
@Extctrls@initialization$qqrv
@Extctrls@Finalization$qqrv
@Printers@initialization$qqrv
@Printers@Finalization$qqrv
@Clipbrd@initialization$qqrv
@Clipbrd@Finalization$qqrv
inet140.bpl
@Sockets@initialization$qqrv
@Sockets@Finalization$qqrv
appbase.bpl
@Ipc_intf@NewHttpServer$qqri
@Ipc_intf@NewMailServer$qqr20System@UnicodeStringt1
@$xp$25Ipc_intf@IJsonHttpServer2
@$xp$24Ipc_intf@IJsonMailServer
@Fsapplc@initialization$qqrv
@Fsapplc@Finalization$qqrv
@Fsapplc@TAppSystem@RegisterService$qqrrx5_GUIDx45System@%DelphiInterface$t17System@IInterface%
@Fsapplc@TAppSystem@CallProc$qqr20System@UnicodeStringrx14System@Variant
@Fsapplc@OEMInfo
@Fsapplc@AppSys
@Fsstrs@initialization$qqrv
@Fsstrs@Finalization$qqrv
@Fssettings@initialization$qqrv
@Fssettings@Finalization$qqrv
@$xp$20Fcintf@IFcInfoSource
@Udhk@initialization$qqrv
@Udhk@Finalization$qqrv
geometry.bpl
@Cadtypes@initialization$qqrv
@Cadtypes@Finalization$qqrv
vclimg140.bpl
@Gifimg@initialization$qqrv
@Gifimg@Finalization$qqrv
@Pngimage@initialization$qqrv
@Pngimage@Finalization$qqrv
@Jpeg@initialization$qqrv
@Jpeg@Finalization$qqrv
Sections
.text Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 1024B - Virtual size: 620B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 88B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 44B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ