Static task
static1
Behavioral task
behavioral1
Sample
89cea5852ce629fdb13927b5c1b1dccd4f953ac6e7c1cbba68ad95e826a92c95.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
89cea5852ce629fdb13927b5c1b1dccd4f953ac6e7c1cbba68ad95e826a92c95.dll
Resource
win10v2004-20240221-en
General
-
Target
89cea5852ce629fdb13927b5c1b1dccd4f953ac6e7c1cbba68ad95e826a92c95
-
Size
199KB
-
MD5
675b3d3bfd86a29ede217aa14ba99715
-
SHA1
61f696adab58250323ceb261379edc03b6445728
-
SHA256
89cea5852ce629fdb13927b5c1b1dccd4f953ac6e7c1cbba68ad95e826a92c95
-
SHA512
2beb675130cef72b443b38b513f8a21f6b75b42861a5d27c078a16c891111efbcd6d516a37aa07c8e3935b99a44e3720ed4be6e1f0f385ba6464b7fe9fbaaaaa
-
SSDEEP
3072:XpfTqkFZyKOo1++zzK1SMiqgxtudtq00U2c:XA2yoHi1SXjtuzuL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 89cea5852ce629fdb13927b5c1b1dccd4f953ac6e7c1cbba68ad95e826a92c95
Files
-
89cea5852ce629fdb13927b5c1b1dccd4f953ac6e7c1cbba68ad95e826a92c95.dll windows:5 windows x86 arch:x86
7691e8b0c3644958029f7d059a179a11
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Imports
rtl140.bpl
@System@initialization$qqrv
@System@Finalization$qqrv
@System@TInterfacedObject@_Release$qqsv
@System@TInterfacedObject@_AddRef$qqsv
@System@TInterfacedObject@QueryInterface$qqsrx5_GUIDpv
@System@TInterfacedObject@NewInstance$qqrv
@System@TInterfacedObject@BeforeDestruction$qqrv
@System@TInterfacedObject@AfterConstruction$qqrv
@System@@IntfAddRef$qqrx45System@%DelphiInterface$t17System@IInterface%
@System@@IntfCast$qqrr45System@%DelphiInterface$t17System@IInterface%x45System@%DelphiInterface$t17System@IInterface%rx5_GUID
@System@@IntfCopy$qqrr45System@%DelphiInterface$t17System@IInterface%x45System@%DelphiInterface$t17System@IInterface%
@System@@IntfClear$qqrr45System@%DelphiInterface$t17System@IInterface%
@System@RegisterModule$qqrp17System@TLibModule
@System@@DynArrayAsg$qqrv
@System@@DynArrayClear$qqrrpvpv
@System@@DynArraySetLength$qqrv
@System@@DynArrayHigh$qqrv
@System@@DynArrayLength$qqrv
@System@WideCharToString$qqrpb
@System@@CopyRecord$qqrv
@System@@AddRefRecord$qqrv
@System@@FinalizeArray$qqrpvt1ui
@System@@FinalizeRecord$qqrpvt1
@System@@InitializeRecord$qqrpvt1
@System@Pos$qqrx20System@UnicodeStringt1
@System@@UniqueStringU$qqrr20System@UnicodeString
@System@@Write0UString$qqrr15System@TTextRecx20System@UnicodeString
@System@@ReadUString$qqrr15System@TTextRecr20System@UnicodeString
@System@@UStrCopy$qqrx20System@UnicodeStringii
@System@@UStrEqual$qqrv
@System@@UStrCatN$qqrv
@System@@UStrCat3$qqrr20System@UnicodeStringx20System@UnicodeStringt2
@System@@UStrCat$qqrr20System@UnicodeStringx20System@UnicodeString
@System@@UStrLen$qqrx20System@UnicodeString
@System@@LStrFromUStr$qqrr27System@%AnsiStringT$us$i0$%x20System@UnicodeStringus
@System@@UStrFromWChar$qqrr20System@UnicodeStringb
@System@@UStrLAsg$qqrr20System@UnicodeStringx20System@UnicodeString
@System@@UStrAsg$qqrr20System@UnicodeStringx20System@UnicodeString
@System@@UStrArrayClr$qqrpvi
@System@@UStrClr$qqrpv
@System@@UStrAddRef$qqrpv
@System@@PWCharLen$qqrpb
@System@@UniqueStringA$qqrr27System@%AnsiStringT$us$i0$%
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%
@System@@LStrFromPWChar$qqrr27System@%AnsiStringT$us$i0$%pbus
@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us
@System@@EnsureUnicodeString$qqrr20System@UnicodeString
@System@@LStrClr$qqrpv
@System@@Assert$qqrx20System@UnicodeStringt1i
@System@@RunError$qqruc
@System@@Halt0$qqrv
@System@@StartLib$qqrv
@System@@TryFinallyExit$qqrv
@System@@DoneExcept$qqrv
@System@@RaiseExcept$qqrv
@System@@HandleFinally$qqrv
@System@@HandleOnException$qqrv
@System@@HandleAnyException$qqrv
@System@@BeforeDestruction$qqrp14System@TObjectzc
@System@@AfterConstruction$qqrp14System@TObject
@System@@ClassDestroy$qqrp14System@TObject
@System@@ClassCreate$qqrp17System@TMetaClasso
@System@TObject@Dispatch$qqrpv
@System@TObject@BeforeDestruction$qqrv
@System@TObject@AfterConstruction$qqrv
@System@TObject@DefaultHandler$qqrpv
@System@TObject@ToString$qqrv
@System@TObject@SafeCallException$qqrp14System@TObjectpv
@System@@SafeIntfAsClass$qqrx45System@%DelphiInterface$t17System@IInterface%p17System@TMetaClass
@System@@AsClass$qqrp14System@TObjectp17System@TMetaClass
@System@TObject@GetHashCode$qqrv
@System@TObject@Equals$qqrp14System@TObject
@System@TObject@Free$qqrv
@System@TObject@$bdtr$qqrv
@System@TObject@$bctr$qqrv
@System@TObject@FreeInstance$qqrv
@System@TObject@NewInstance$qqrv
@System@@SetUnion$qqrv
@System@@SetEq$qqrv
@System@@SetElem$qqrv
@System@@WriteLn$qqrr15System@TTextRec
@System@@ReadLn$qqrr15System@TTextRec
@System@@FillChar$qqrpvib
@System@@EofText$qqrr15System@TTextRec
@System@@Close$qqrr15System@TTextRec
@System@@Assign$qqrr15System@TTextRecpxb
@System@@ResetText$qqrr15System@TTextRec
@System@@AbstractError$qqrv
@System@Move$qqrpxvpvi
@System@@_IOTest$qqrv
@System@Output
@$xp$12System@PByte
@$xp$24System@TInterfacedObject
@System@TInterfacedObject@
@$xp$18System@IEnumerable
@$xp$17System@IInterface
@$xp$14System@TObject
@System@TObject@
@$xp$5TGUID
@$xp$7HRESULT
@$xp$13System@string
@$xp$6Double
@$xp$6Single
@$xp$6UInt64
@$xp$8Cardinal
@$xp$11System@Word
@$xp$11System@Byte
@$xp$7Integer
@$xp$7Boolean
@Sysutils@initialization$qqrv
@Sysutils@Finalization$qqrv
@Sysutils@StringOf$qqrx25System@%DynamicArray$tuc%
@Sysutils@TEncoding@$bcdtr$qqrv
@Sysutils@TLanguages@$bcdtr$qqrv
@Sysutils@Supports$qqrpx14System@TObjectrx5_GUID
@Sysutils@Supports$qqrpx14System@TObjectrx5_GUIDpv
@Sysutils@FreeAndNil$qqrpv
@Sysutils@StringReplace$qqrx20System@UnicodeStringt1t149System@%Set$t21Sysutils@Sysutils__55$iuc$0$iuc$1%
@Sysutils@Exception@$bcdtr$qqrv
@Sysutils@Exception@$bcctr$qqrv
@Sysutils@Exception@$bctr$qqrp20System@TResStringRec
@Sysutils@Exception@$bctr$qqrx20System@UnicodeString
@Sysutils@OutOfMemoryError$qqrv
@Sysutils@Format$qqrx20System@UnicodeStringpx14System@TVarRecxi
@Sysutils@ExtractFilePath$qqrx20System@UnicodeString
@Sysutils@FindClose$qqrr19Sysutils@TSearchRec
@Sysutils@FindNext$qqrr19Sysutils@TSearchRec
@Sysutils@FindFirst$qqrx20System@UnicodeStringir19Sysutils@TSearchRec
@Sysutils@FileExists$qqrx20System@UnicodeString
@Sysutils@StrToInt$qqrx20System@UnicodeString
@Sysutils@IntToHex$qqrji
@Sysutils@IntToHex$qqrii
@Sysutils@IntToStr$qqri
@Sysutils@CompareMem$qqrpvt1i
@$xp$14Sysutils@TProc
@Sysutils@TEncoding@$bcctr$qqrv
@Sysutils@EInvalidCast@
@Sysutils@EArgumentOutOfRangeException@
@Sysutils@Exception@
@$xp$19Sysutils@TSearchRec
@$xp$19Sysutils@PByteArray
@$xp$15Sysutils@TBytes
@Sysutils@TLanguages@$bcctr$qqrv
@Sysconst@_SInvalidCast
@Rtlconsts@_SGenericDuplicateItem
@Rtlconsts@_SGenericItemNotFound
@Rtlconsts@_SArgumentOutOfRange
@Classes@initialization$qqrv
@Classes@Finalization$qqrv
@Classes@TThread@DoTerminate$qqrv
@Classes@TThread@AfterConstruction$qqrv
@Classes@TThread@$bcdtr$qqrv
@Classes@TThread@$bdtr$qqrv
@Classes@TThread@$bcctr$qqrv
@Classes@TThread@$bctr$qqro
@Classes@TFileStream@$bctr$qqrx20System@UnicodeStringus
@Classes@TInterfacedPersistent@QueryInterface$qqsrx5_GUIDpv
@Classes@TInterfacedPersistent@_Release$qqsv
@Classes@TInterfacedPersistent@_AddRef$qqsv
@Classes@TInterfacedPersistent@AfterConstruction$qqrv
@Classes@TPersistent@DefineProperties$qqrp14Classes@TFiler
@Classes@TPersistent@AssignTo$qqrp19Classes@TPersistent
@Classes@TPersistent@Assign$qqrp19Classes@TPersistent
@Classes@TPersistent@$bdtr$qqrv
@$xp$15Classes@TThread
@Classes@TThread@
@Classes@TFileStream@
@$xp$29Classes@TInterfacedPersistent
@Classes@TInterfacedPersistent@
@Classes@EListError@
@Typinfo@initialization$qqrv
@Typinfo@Finalization$qqrv
@Variants@initialization$qqrv
@Variants@Finalization$qqrv
@Variants@@VarToInteger$qqrrx8TVarData
@Varutils@initialization$qqrv
@Varutils@Finalization$qqrv
@Generics_collections@InCircularRange$qqriii
@$xp$42Generics_collections@TDictionaryOwnerships
@$xp$44Generics_collections@TCollectionNotification
@Generics_collections@TArray@
@Generics_defaults@_LookupVtableInfo$qqr42Generics_defaults@TDefaultGenericInterfacep17Typinfo@TTypeInfoi
@Inifiles@initialization$qqrv
@Inifiles@Finalization$qqrv
@Ioutils@initialization$qqrv
@Ioutils@Finalization$qqrv
@Ioutils@TPath@$bcctr$qqrv
@Ioutils@TPath@$bcdtr$qqrv
@Syncobjs@initialization$qqrv
@Syncobjs@Finalization$qqrv
@Syncobjs@TCriticalSection@Leave$qqrv
@Syncobjs@TCriticalSection@Enter$qqrv
@Syncobjs@TCriticalSection@$bctr$qqrv
@$xp$25Syncobjs@TCriticalSection
@Syncobjs@TCriticalSection@
@Timespan@TTimeSpan@$bcctr$qqrv
@Timespan@TTimeSpan@$bcdtr$qqrv
@Rtti@initialization$qqrv
@Rtti@Finalization$qqrv
@Varconv@initialization$qqrv
@Varconv@Finalization$qqrv
@Convutils@initialization$qqrv
@Convutils@Finalization$qqrv
@Varcmplx@initialization$qqrv
@Varcmplx@Finalization$qqrv
@Registry@initialization$qqrv
@Registry@Finalization$qqrv
@Comobj@initialization$qqrv
@Comobj@Finalization$qqrv
@Uxtheme@initialization$qqrv
@Uxtheme@Finalization$qqrv
@Helpintfs@initialization$qqrv
@Helpintfs@Finalization$qqrv
@Multimon@initialization$qqrv
@Multimon@Finalization$qqrv
@Flatsb@initialization$qqrv
@Flatsb@Finalization$qqrv
kernel32
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
Sleep
TerminateProcess
Sleep
OpenProcess
GetVersionExW
GetTickCount
GetProcAddress
GetModuleHandleW
GetLastError
GetCurrentProcess
FreeLibrary
CloseHandle
advapi32
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
shell32
ShellExecuteW
appbase.bpl
@Fsapplc@initialization$qqrv
@Fsapplc@Finalization$qqrv
@Fsapplc@TAppSystem@RegisterService$qqrrx5_GUIDx45System@%DelphiInterface$t17System@IInterface%
@Fsapplc@TAppSystem@RegisterProc$qqr20System@UnicodeStringpqqrv$v
@Fsapplc@TAppSystem@RegisterProc$qqr20System@UnicodeStringpqqrrx14System@Variant$i
@Fsapplc@TAppSystem@RegisterCreator$qqr20System@UnicodeStringpqqrp14System@TObject$p14System@TObject
@Fsapplc@TAppSystem@LogMsg$qqr19Fsapplc@TAppMsgTypex20System@UnicodeString20System@UnicodeStringii
@Fsapplc@TAppSystem@GetObject$qqrp14System@TObject20System@UnicodeString
@Fsapplc@TAppSystem@CallProc$qqr20System@UnicodeStringi
@Fsapplc@TAppSystem@CallProc$qqr20System@UnicodeString
@Fsapplc@TThreadHelper@NameThreadForDebugging$qqr20System@UnicodeString
@Fsapplc@AppSys
@Fsstrs@initialization$qqrv
@Fsstrs@Finalization$qqrv
@Fssettings@initialization$qqrv
@Fssettings@Finalization$qqrv
@Udhk@initialization$qqrv
@Udhk@Finalization$qqrv
baselib.bpl
@Superobject@TSuperObjectHelper@ToJson$qqrp29Superobject@TSuperRttiContext
@Superobject@TSuperTableString@GetI$qqrx20System@UnicodeString
@Superobject@TSuperArray@GetO$qqrxi
@Superobject@SO$qqrx20System@UnicodeString
@$xp$29Superobject@TSuperRttiContext
@$xp$24Superobject@ISuperObject
@$xp$23Superobject@TSuperArray
@Fslib@initialization$qqrv
@Fslib@Finalization$qqrv
@Fslib@Json$qqrx20System@UnicodeString
@Regularexpressions@initialization$qqrv
@Regularexpressions@Finalization$qqrv
@Cfgvnt@initialization$qqrv
@Cfgvnt@Finalization$qqrv
@Sevenzip@initialization$qqrv
@Sevenzip@Finalization$qqrv
@Fsmui@initialization$qqrv
@Fsmui@Finalization$qqrv
@Fsoem@initialization$qqrv
@Fsoem@Finalization$qqrv
@Bmxcarddef@initialization$qqrv
@Bmxcarddef@Finalization$qqrv
@Fssocket@initialization$qqrv
@Fssocket@Finalization$qqrv
nativexml401.bpl
@Nativexml@initialization$qqrv
@Nativexml@Finalization$qqrv
@Sddebug@initialization$qqrv
@Sddebug@Finalization$qqrv
vcl140.bpl
@Graphics@initialization$qqrv
@Graphics@Finalization$qqrv
@Forms@initialization$qqrv
@Forms@Finalization$qqrv
@Actnlist@initialization$qqrv
@Actnlist@Finalization$qqrv
@Themes@initialization$qqrv
@Themes@Finalization$qqrv
@Controls@initialization$qqrv
@Controls@Finalization$qqrv
@Menus@initialization$qqrv
@Menus@Finalization$qqrv
@Dialogs@initialization$qqrv
@Dialogs@Finalization$qqrv
@Comctrls@initialization$qqrv
@Comctrls@Finalization$qqrv
@Graphutil@initialization$qqrv
@Graphutil@Finalization$qqrv
@Extctrls@initialization$qqrv
@Extctrls@Finalization$qqrv
@Printers@initialization$qqrv
@Printers@Finalization$qqrv
@Clipbrd@initialization$qqrv
@Clipbrd@Finalization$qqrv
inet140.bpl
@Sockets@initialization$qqrv
@Sockets@Finalization$qqrv
geometry.bpl
@Cadtypes@initialization$qqrv
@Cadtypes@Finalization$qqrv
vclimg140.bpl
@Gifimg@initialization$qqrv
@Gifimg@Finalization$qqrv
@Pngimage@initialization$qqrv
@Pngimage@Finalization$qqrv
@Jpeg@initialization$qqrv
@Jpeg@Finalization$qqrv
Sections
.text Size: 158KB - Virtual size: 157KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 648B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ