8c39ecc9fbe8c63848f2257ed35dbbac

Sharing

Copy URL Twitter E-mail

General

Target

8c39ecc9fbe8c63848f2257ed35dbbac
Size

207KB
MD5

8c39ecc9fbe8c63848f2257ed35dbbac
SHA1

c5d9d399a99e4ab8519bf3b2ec7992b9b664347c
SHA256

4f7360b6d53df6bf2e3894fe7174771e980be0e603bbf92f2357c97154d56b2b
SHA512

6e6fbffd7cbed862062e31e9c4125f86eb443a408b1e639af2021bd8768aa0d7e3899e532d8eeb8eab1a54d189475138f7d2625af3d2c3a572181f3457b86d08
SSDEEP

3072:6GIQ6R14oDo1d5n8odEQCjeiGwTdgY6g20TU89pQ7nsqYanTNtML:6Gw7o1gb1R297+aT6

Score

1^/10

Malware Config

Signatures

Files

8c39ecc9fbe8c63848f2257ed35dbbac
.dll windows:5 windows x86 arch:x86

c5926142f36c29a542f97de427ee7302

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

9c:c0:1d:db:72:3b:1b:1f:92:6a:2a:1a:ee:67:44:b0
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

29/02/2016, 00:00

Not After

28/02/2017, 23:59

Subject

CN=pc speedup pro,OU=management,O=pc speedup pro,POSTALCODE=302039,STREET=MURLIPURA+STREET=104 Surya Nagar,L=Jaipur,ST=Rajasthan,C=IN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d8:6a:1c:92:ba:50:8d:30:39:2f:0d:22:d1:cb:56:44:cb:db:93:56
Signer

Actual PE Digest

d8:6a:1c:92:ba:50:8d:30:39:2f:0d:22:d1:cb:56:44:cb:db:93:56

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

rtl160.bpl

@System@initialization$qqrv
@System@Finalization$qqrv
@System@@CheckAutoResult$qqrl
@System@TInterfacedObject@_Release$qqsv
@System@TInterfacedObject@_AddRef$qqsv
@System@TInterfacedObject@QueryInterface$qqsrx5_GUIDpv
@System@TInterfacedObject@NewInstance$qqrv
@System@TInterfacedObject@BeforeDestruction$qqrv
@System@TInterfacedObject@AfterConstruction$qqrv
@System@@IntfAddRef$qqrx45System@%DelphiInterface$t17System@IInterface%
@System@@IntfCast$qqrr45System@%DelphiInterface$t17System@IInterface%x45System@%DelphiInterface$t17System@IInterface%rx5_GUID
@System@@IntfCopy$qqrr45System@%DelphiInterface$t17System@IInterface%x45System@%DelphiInterface$t17System@IInterface%
@System@@IntfClear$qqrr45System@%DelphiInterface$t17System@IInterface%
@System@RegisterModule$qqrp17System@TLibModule
@System@@FinalizeArray$qqrpvt1ui
@System@@UStrDelete$qqrr20System@UnicodeStringii
@System@@UStrCopy$qqrx20System@UnicodeStringii
@System@@UStrCatN$qqrv
@System@@UStrCat3$qqrr20System@UnicodeStringx20System@UnicodeStringt2
@System@@UStrCat$qqrr20System@UnicodeStringx20System@UnicodeString
@System@@WStrFromUStr$qqrr17System@WideStringx20System@UnicodeString
@System@@UStrFromWStr$qqrr20System@UnicodeStringx17System@WideString
@System@@UStrFromWArray$qqrr20System@UnicodeStringpbi
@System@@UStrFromPWChar$qqrr20System@UnicodeStringpb
@System@@UStrFromWChar$qqrr20System@UnicodeStringb
@System@@UStrToPWChar$qqrx20System@UnicodeString
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%
@System@@LStrFromPWChar$qqrr27System@%AnsiStringT$us$i0$%pbus
@System@@PCharLen$qqrpc
@System@@UStrLen$qqrx20System@UnicodeString
@System@@UStrLAsg$qqrr20System@UnicodeStringx20System@UnicodeString
@System@@UStrAsg$qqrr20System@UnicodeStringx20System@UnicodeString
@System@@WStrArrayClr$qqrpvi
@System@@UStrArrayClr$qqrpvi
@System@@WStrClr$qqrpv
@System@@LStrClr$qqrpv
@System@@UStrClr$qqrpv
@System@@Assert$qqrx20System@UnicodeStringt1i
@System@@RunError$qqruc
@System@@Halt0$qqrv
@System@@StartLib$qqrv
@System@@TryFinallyExit$qqrv
@System@@DoneExcept$qqrv
@System@@RaiseExcept$qqrv
@System@@HandleFinally$qqrv
@System@@HandleOnException$qqrv
@System@@HandleAnyException$qqrv
@System@@BeforeDestruction$qqrp14System@TObjectzc
@System@@AfterConstruction$qqrp14System@TObject
@System@@ClassDestroy$qqrp14System@TObject
@System@@ClassCreate$qqrpvzc
@System@TObject@Dispatch$qqrpv
@System@TObject@BeforeDestruction$qqrv
@System@TObject@AfterConstruction$qqrv
@System@TObject@DefaultHandler$qqrpv
@System@TObject@ToString$qqrv
@System@TObject@SafeCallException$qqrp14System@TObjectpv
@System@TObject@GetHashCode$qqrv
@System@TObject@Equals$qqrp14System@TObject
@System@TObject@$bdtr$qqrv
@System@TObject@FreeInstance$qqrv
@System@TObject@NewInstance$qqrv
@System@@FillChar$qqrpvic
@System@@TRUNC$qqrv
@System@@ROUND$qqrv
@System@Move$qqrpxvpvi
@System@Error$qqr20System@TRuntimeError
@System@ExceptObject$qqrv
@System@IsMemoryManagerSet$qqrv
@System@SetMemoryManager$qqrrx23System@TMemoryManagerEx
@System@GetMemoryManager$qqrr23System@TMemoryManagerEx
@System@GetHeapStatus$qqrv
@System@ReportMemoryLeaksOnShutdown
@System@IsLibrary
@$xp$16System@TDateTime
@$xp$17System@IInterface
@$xp$14System@TObject
@System@TObject@
@$xp$7HRESULT
@$xp$17System@OleVariant
@$xp$13System@string
@$xp$7Integer
@$xp$7Boolean
@Winapi@Activex@Failed$qqrl
@Winapi@Activex@Succeeded$qqrl
@System@Internal@Excutils@initialization$qqrv
@System@Internal@Excutils@Finalization$qqrv
@System@Sysutils@initialization$qqrv
@System@Sysutils@Finalization$qqrv
@System@Sysutils@TOSVersion@$bcctr$qqrv
@System@Sysutils@TEncoding@$bcdtr$qqrv
@System@Sysutils@TLanguages@$bcdtr$qqrv
@System@Sysutils@FreeAndNil$qqrpv
@System@Sysutils@GetModuleName$qqrui
@System@Sysutils@StringReplace$qqrx20System@UnicodeStringt1t163System@%Set$t35System@Sysutils@System_Sysutils__85$iuc$0$iuc$1%
@System@Sysutils@IncludeTrailingPathDelimiter$qqrx20System@UnicodeString
@System@Sysutils@Exception@$bcdtr$qqrv
@System@Sysutils@Exception@$bcctr$qqrv
@System@Sysutils@Exception@ToString$qqrv
@System@Sysutils@Exception@RaisingException$qqrp23System@TExceptionRecord
@System@Sysutils@Exception@GetBaseException$qqrv
@System@Sysutils@Exception@$bdtr$qqrv
@System@Sysutils@Exception@$bctr$qqrx20System@UnicodeString
@System@Sysutils@SysErrorMessage$qqrui
@System@Sysutils@FormatDateTime$qqrx20System@UnicodeString16System@TDateTime
@System@Sysutils@IncMonth$qqrx16System@TDateTimei
@System@Sysutils@Now$qqrv
@System@Sysutils@SystemTimeToDateTime$qqrrx11_SYSTEMTIME
@System@Sysutils@DecodeDate$qqrx16System@TDateTimerust2t2
@System@Sysutils@EncodeDate$qqrususus
@System@Sysutils@DecodeTime$qqrx16System@TDateTimerust2t2t2
@System@Sysutils@EncodeTime$qqrusususus
@System@Sysutils@StrToFloat$qqrx20System@UnicodeString
@System@Sysutils@Format$qqrx20System@UnicodeStringpx14System@TVarRecxi
@System@Sysutils@ExtractFileName$qqrx20System@UnicodeString
@System@Sysutils@ExtractFilePath$qqrx20System@UnicodeString
@System@Sysutils@ChangeFileExt$qqrx20System@UnicodeStringt1
@System@Sysutils@DeleteFile$qqrx20System@UnicodeString
@System@Sysutils@FileExists$qqrx20System@UnicodeStringo
@System@Sysutils@StrToInt$qqrx20System@UnicodeString
@System@Sysutils@IntToHex$qqrii
@System@Sysutils@IntToStr$qqri
@System@Sysutils@Trim$qqrx20System@UnicodeString
@System@Sysutils@SameText$qqrx20System@UnicodeStringt1
@System@Sysutils@CharInSet$qqrbrx29System@%Set$tc$iuc$0$iuc$255%
@System@Sysutils@IsEqualGUID$qqrrx5_GUIDt1
@System@Sysutils@TOSVersion@$bcdtr$qqrv
@System@Sysutils@TEncoding@$bcctr$qqrv
@System@Sysutils@CurrencyString
@System@Sysutils@EmptyStr
@$xp$25System@Sysutils@Exception
@System@Sysutils@Exception@
@System@Sysutils@TLanguages@$bcctr$qqrv
@System@Varutils@initialization$qqrv
@System@Varutils@Finalization$qqrv
@System@Variants@initialization$qqrv
@System@Variants@Finalization$qqrv
@System@Variants@Null$qqrv
@System@Variants@@VarAddRef$qqrr8TVarData
@System@Variants@@OleVarFromVar$qqrr8TVarDatarx8TVarData
@System@Variants@@OleVarFromUStr$qqrr8TVarDatax20System@UnicodeString
@System@Variants@@VarFromWStr$qqrr8TVarDatax17System@WideString
@System@Variants@@OleVarFromInt$qqrr8TVarDataxixzc
@System@Variants@@VarClr$qqrr8TVarData
@System@Typinfo@initialization$qqrv
@System@Typinfo@Finalization$qqrv
@System@Classes@initialization$qqrv
@System@Classes@Finalization$qqrv
@System@Classes@TObserverMapping@$bcdtr$qqrv
@System@Classes@TLoginCredentialService@$bcdtr$qqrv
@System@Classes@TLoginCredentialService@$bcctr$qqrv
@System@Classes@TBinaryWriter@$bcdtr$qqrv
@System@Classes@TThread@$bcdtr$qqrv
@System@Classes@TThread@$bcctr$qqrv
@System@Classes@TStringList@$bctr$qqrv
@System@Classes@TStrings@SetValueFromIndex$qqrix20System@UnicodeString
@System@Classes@TStrings@GetValueFromIndex$qqri
@System@Classes@TStrings@GetNameValueSeparator$qqrv
@System@Classes@TStrings@CompareStrings$qqrx20System@UnicodeStringt1
@System@Classes@TStrings@SetStrictDelimiter$qqrxo
@System@Classes@TStrings@SetQuoteChar$qqrxb
@System@Classes@TStrings@SetDelimiter$qqrxb
@System@Classes@TStrings@SetDelimitedText$qqrx20System@UnicodeString
@System@Classes@TStrings@SetValue$qqrx20System@UnicodeStringt1
@System@Classes@TStrings@SetUpdateState$qqro
@System@Classes@TStrings@SetTextStr$qqrx20System@UnicodeString
@System@Classes@TStrings@SetText$qqrpb
@System@Classes@TStrings@SetCapacity$qqri
@System@Classes@TStrings@SaveToStream$qqrp22System@Classes@TStreamp25System@Sysutils@TEncoding
@System@Classes@TStrings@SaveToStream$qqrp22System@Classes@TStream
@System@Classes@TStrings@SaveToFile$qqrx20System@UnicodeStringp25System@Sysutils@TEncoding
@System@Classes@TStrings@SaveToFile$qqrx20System@UnicodeString
@System@Classes@TStrings@PutObject$qqrip14System@TObject
@System@Classes@TStrings@Put$qqrix20System@UnicodeString
@System@Classes@TStrings@Move$qqrii
@System@Classes@TStrings@LoadFromStream$qqrp22System@Classes@TStreamp25System@Sysutils@TEncoding
@System@Classes@TStrings@LoadFromStream$qqrp22System@Classes@TStream
@System@Classes@TStrings@LoadFromFile$qqrx20System@UnicodeStringp25System@Sysutils@TEncoding
@System@Classes@TStrings@LoadFromFile$qqrx20System@UnicodeString
@System@Classes@TStrings@InsertObject$qqrix20System@UnicodeStringp14System@TObject
@System@Classes@TStrings@IndexOfObject$qqrp14System@TObject
@System@Classes@TStrings@IndexOfName$qqrx20System@UnicodeString
@System@Classes@TStrings@IndexOf$qqrx20System@UnicodeString
@System@Classes@TStrings@GetValue$qqrx20System@UnicodeString
@System@Classes@TStrings@GetTextStr$qqrv
@System@Classes@TStrings@GetText$qqrv
@System@Classes@TStrings@GetObject$qqri
@System@Classes@TStrings@GetName$qqri
@System@Classes@TStrings@GetCapacity$qqrv
@System@Classes@TStrings@ExtractName$qqrx20System@UnicodeString
@System@Classes@TStrings@Exchange$qqrii
@System@Classes@TStrings@DefineProperties$qqrp21System@Classes@TFiler
@System@Classes@TStrings@Assign$qqrp26System@Classes@TPersistent
@System@Classes@TStrings@AddStrings$qqrp23System@Classes@TStrings
@System@Classes@TStrings@AddObject$qqrx20System@UnicodeStringp14System@TObject
@System@Classes@TStrings@Add$qqrx20System@UnicodeString
@System@Classes@TStrings@$bdtr$qqrv
@System@Classes@TStrings@$bctr$qqrv
@System@Classes@TPersistent@AssignTo$qqrp26System@Classes@TPersistent
@System@Classes@TBinaryWriter@$bcctr$qqrv
@System@Classes@TStringList@
@$xp$23System@Classes@TStrings
@System@Classes@TStrings@
@System@Classes@TObserverMapping@$bcctr$qqrv
@System@Win@Comobj@initialization$qqrv
@System@Win@Comobj@Finalization$qqrv
@System@Win@Comobj@TComServerObject@$bcctr$qqrv
@System@Win@Comobj@EOleSysError@
@System@Win@Comobj@TComServerObject@$bcdtr$qqrv
@System@Math@initialization$qqrv
@System@Math@Finalization$qqrv
@System@Math@Min$qqrxjxj
@System@Timespan@TTimeSpan@$bcctr$qqrv
@System@Timespan@TTimeSpan@$bcdtr$qqrv
@System@Syncobjs@initialization$qqrv
@System@Syncobjs@Finalization$qqrv
@System@Strutils@EndsText$qqrx20System@UnicodeStringt1
@System@Strutils@StartsText$qqrx20System@UnicodeStringt1
@System@Rtti@initialization$qqrv
@System@Rtti@Finalization$qqrv
@System@Dateutils@TTimeZone@$bcdtr$qqrv
@System@Dateutils@TTimeZone@$bcctr$qqrv
@System@Dateutils@IncDay$qqrx16System@TDateTimexi
@System@Dateutils@IncYear$qqrx16System@TDateTimexi
@System@Dateutils@MilliSecondsBetween$qqrx16System@TDateTimet1
@System@Dateutils@MinutesBetween$qqrx16System@TDateTimet1
@System@Dateutils@MinuteOf$qqrx16System@TDateTime
@System@Dateutils@HourOf$qqrx16System@TDateTime
@System@Dateutils@DayOf$qqrx16System@TDateTime
@System@Dateutils@MonthOf$qqrx16System@TDateTime
@System@Dateutils@YearOf$qqrx16System@TDateTime
@System@Ioutils@initialization$qqrv
@System@Ioutils@Finalization$qqrv
@System@Ioutils@TPath@$bcctr$qqrv
@System@Ioutils@TPath@$bcdtr$qqrv
@System@Inifiles@initialization$qqrv
@System@Inifiles@Finalization$qqrv
@System@Win@Registry@initialization$qqrv
@System@Win@Registry@Finalization$qqrv
@System@Win@Registry@TRegistry@$bcctr$qqrv
@System@Win@Registry@TRegistry@$bcdtr$qqrv

kernel32

GetProcAddress
RaiseException
LoadLibraryA
GetLastError
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
FreeLibrary
WriteFile
VirtualQuery
VirtualFree
VirtualAlloc
UnmapViewOfFile
SwitchToThread
SetFilePointer
RaiseException
OutputDebugStringA
OpenFileMappingA
MapViewOfFile
LoadLibraryW
GetWindowsDirectoryW
GetVersionExW
GetTickCount
GetProcAddress
GetModuleFileNameA
GetLocalTime
GetEnvironmentVariableA
GetCurrentProcessId
GetCurrentProcess
FreeLibrary
DeleteFileA
CreateFileMappingA
CreateFileA
CloseHandle
Sleep

user32

MessageBoxA

shfolder

SHGetFolderPathA

ole32

CoTaskMemFree
CoCreateInstance

axcomponentsrtl.bpl

@Auslogics@Debug@Common@initialization$qqrv
@Auslogics@Debug@Common@Finalization$qqrv
@Auslogics@Debug@Helper@initialization$qqrv
@Auslogics@Debug@Helper@Finalization$qqrv
@Auslogics@Debug@Logfile@initialization$qqrv
@Auslogics@Debug@Logfile@Finalization$qqrv
@Auslogics@Dllroutines@initialization$qqrv
@Auslogics@Dllroutines@Finalization$qqrv
@Auslogics@Winapi@Psapi@PsAPI@GetModuleFileNameEx$qqruiui
@Auslogics@System@Fileversioninfo@TFileVersionInfo@GetIsAviable$qqrv
@Auslogics@System@Fileversioninfo@TFileVersionInfo@$bctr$qqrx20System@UnicodeStringo
@Auslogics@System@Fileversioninfo@TFileVersionInfo@
@Auslogics@Winapi@Kernel32@initialization$qqrv
@Auslogics@Winapi@Kernel32@Finalization$qqrv
@Auslogics@System@Win@Registry@initialization$qqrv
@Auslogics@System@Win@Registry@Finalization$qqrv
@Auslogics@System@Win@Osinfo@initialization$qqrv
@Auslogics@System@Win@Osinfo@Finalization$qqrv
@Auslogics@System@Win@Osinfo@OSInfo@IsWindows$qqr43Auslogics@System@Win@Osinfo@TWindowsVersiont1
@Auslogics@Project@Processinfo@initialization$qqrv
@Auslogics@Project@Processinfo@Finalization$qqrv
@Auslogics@Project@Processinfo@ProcessInfo@ShellExecute$qqrp6HWND__x20System@UnicodeStringt2t2t2i
@Auslogics@Typelibrary@Mstask@IID_IPersistFile
@Auslogics@Typelibrary@Mstask@CLSID_CSchedulingAgent
@Auslogics@Typelibrary@Mstask@CLSID_CTask
@$xp$14ITaskScheduler
@Auslogics@Typelibrary@Mstask@IID_ITaskScheduler
@$xp$5ITask
@Auslogics@Typelibrary@Mstask@IID_ITask
@$xp$12ITaskTrigger
@Auslogics@Typelibrary@Taskscheduler@CoTaskScheduler_@Create$qqrv
@$xp$48Auslogics@Typelibrary@Taskscheduler@IEmailAction
@$xp$53Auslogics@Typelibrary@Taskscheduler@IComHandlerAction
@$xp$54Auslogics@Typelibrary@Taskscheduler@IShowMessageAction
@$xp$47Auslogics@Typelibrary@Taskscheduler@IExecAction
@$xp$56Auslogics@Typelibrary@Taskscheduler@IRegistrationTrigger
@$xp$48Auslogics@Typelibrary@Taskscheduler@IBootTrigger
@$xp$54Auslogics@Typelibrary@Taskscheduler@IMonthlyDOWTrigger
@$xp$51Auslogics@Typelibrary@Taskscheduler@IMonthlyTrigger
@$xp$50Auslogics@Typelibrary@Taskscheduler@IWeeklyTrigger
@$xp$49Auslogics@Typelibrary@Taskscheduler@IDailyTrigger
@$xp$48Auslogics@Typelibrary@Taskscheduler@ITimeTrigger
@$xp$49Auslogics@Typelibrary@Taskscheduler@IEventTrigger
@$xp$62Auslogics@Typelibrary@Taskscheduler@ISessionStateChangeTrigger
@$xp$49Auslogics@Typelibrary@Taskscheduler@ILogonTrigger
@$xp$48Auslogics@Typelibrary@Taskscheduler@IIdleTrigger
@$xp$61Auslogics@Typelibrary@Taskscheduler@ITaskNamedValueCollection
@$xp$48Auslogics@Typelibrary@Taskscheduler@ITaskService
@$xp$43Auslogics@Typelibrary@Taskscheduler@IAction
@$xp$53Auslogics@Typelibrary@Taskscheduler@IActionCollection
@$xp$46Auslogics@Typelibrary@Taskscheduler@IPrincipal
@$xp$49Auslogics@Typelibrary@Taskscheduler@ITaskSettings
@$xp$44Auslogics@Typelibrary@Taskscheduler@ITrigger
@$xp$54Auslogics@Typelibrary@Taskscheduler@ITriggerCollection
@$xp$53Auslogics@Typelibrary@Taskscheduler@IRegistrationInfo
@$xp$51Auslogics@Typelibrary@Taskscheduler@ITaskDefinition
@$xp$51Auslogics@Typelibrary@Taskscheduler@IRegisteredTask
@$xp$47Auslogics@Typelibrary@Taskscheduler@ITaskFolder
@Auslogics@Typelibrary@Taskscheduler@IID_IEmailAction
@Auslogics@Typelibrary@Taskscheduler@IID_IComHandlerAction
@Auslogics@Typelibrary@Taskscheduler@IID_IShowMessageAction
@Auslogics@Typelibrary@Taskscheduler@IID_IExecAction
@Auslogics@Typelibrary@Taskscheduler@IID_IRegistrationTrigger
@Auslogics@Typelibrary@Taskscheduler@IID_IBootTrigger
@Auslogics@Typelibrary@Taskscheduler@IID_IMonthlyDOWTrigger
@Auslogics@Typelibrary@Taskscheduler@IID_IMonthlyTrigger
@Auslogics@Typelibrary@Taskscheduler@IID_IWeeklyTrigger
@Auslogics@Typelibrary@Taskscheduler@IID_IDailyTrigger
@Auslogics@Typelibrary@Taskscheduler@IID_ITimeTrigger
@Auslogics@Typelibrary@Taskscheduler@IID_IEventTrigger
@Auslogics@Typelibrary@Taskscheduler@IID_ISessionStateChangeTrigger
@Auslogics@Typelibrary@Taskscheduler@IID_ILogonTrigger
@Auslogics@Typelibrary@Taskscheduler@IID_IIdleTrigger
@Auslogics@Project@Interfacedobject@initialization$qqrv
@Auslogics@Project@Interfacedobject@Finalization$qqrv
@Auslogics@Project@Interfacedobject@TInterfacedObject@DoProxiedObjectFree$qqrv
@Auslogics@Project@Interfacedobject@TInterfacedObject@DefaultHandler$qqrpv
@Auslogics@Project@Interfacedobject@TInterfacedObject@$bdtr$qqrv
@Auslogics@Project@Interfacedobject@TInterfacedObject@$bctr$qqrp58Auslogics@Project@Interfacedobject@TProxiedInterfaceObject
@Auslogics@Project@Interfacedobject@TInterfacedObject@GetInstanceCount$qqrp17System@TMetaClass
@$xp$52Auslogics@Project@Interfacedobject@TInterfacedObject
@Auslogics@Project@Interfacedobject@TInterfacedObject@
@Auslogics@System@Win@Localuserlist@TLocalUserList@GetItems$qqri
@Auslogics@System@Win@Localuserlist@TLocalUserList@GetCount$qqrv
@Auslogics@System@Win@Localuserlist@TLocalUserList@$bctr$qqrv
@Auslogics@System@Win@Localuserlist@TLocalUserList@
@Auslogics@System@Win@Aclhelper@TAclHelper@AddAllowedAce$qqruipv
@Auslogics@System@Win@Aclhelper@TAclHelper@SetOwner$qqrpv
@Auslogics@System@Win@Aclhelper@TAclHelper@$bctr$qqrx20System@UnicodeString40Auslogics@Winapi@Advapi32@SE_OBJECT_TYPE
@Auslogics@System@Win@Aclhelper@TAclHelper@

advapi32

StartServiceW
QueryServiceStatus
OpenServiceW
OpenSCManagerW
ControlService
CloseServiceHandle

Exports

Exports

DllCanUnloadNow
DllGetInstance
DllGetVersion
RunTaskW

Sections

.text
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 512B - Virtual size: 400B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 15KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 158B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c5926142f36c29a542f97de427ee7302

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

9c:c0:1d:db:72:3b:1b:1f:92:6a:2a:1a:ee:67:44:b0Certificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

d8:6a:1c:92:ba:50:8d:30:39:2f:0d:22:d1:cb:56:44:cb:db:93:56Signer

Headers

File Characteristics

Imports

rtl160.bpl

kernel32

user32

shfolder

ole32

axcomponentsrtl.bpl

advapi32

Exports

Exports

Sections

.text Size: 123KB - Virtual size: 122KB

.itext Size: 512B - Virtual size: 400B

.data Size: 2KB - Virtual size: 2KB

.bss Size: - Virtual size: 15KB

.idata Size: 22KB - Virtual size: 21KB

.edata Size: 512B - Virtual size: 158B

.reloc Size: 11KB - Virtual size: 10KB

.rsrc Size: 41KB - Virtual size: 40KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

9c:c0:1d:db:72:3b:1b:1f:92:6a:2a:1a:ee:67:44:b0
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

d8:6a:1c:92:ba:50:8d:30:39:2f:0d:22:d1:cb:56:44:cb:db:93:56
Signer

.text
Size: 123KB - Virtual size: 122KB

.itext
Size: 512B - Virtual size: 400B

.data
Size: 2KB - Virtual size: 2KB

.bss
Size: - Virtual size: 15KB

.idata
Size: 22KB - Virtual size: 21KB

.edata
Size: 512B - Virtual size: 158B

.reloc
Size: 11KB - Virtual size: 10KB

.rsrc
Size: 41KB - Virtual size: 40KB