Static task
static1
Behavioral task
behavioral1
Sample
af5e1bfe166b897cf4d89248ea0a326c36fd7e14fa339c15928f3709446654dd.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
af5e1bfe166b897cf4d89248ea0a326c36fd7e14fa339c15928f3709446654dd.exe
Resource
win10v2004-20240226-en
General
-
Target
af5e1bfe166b897cf4d89248ea0a326c36fd7e14fa339c15928f3709446654dd
-
Size
3.8MB
-
MD5
3aae3ae9a0dd2000171607c2d933e7ca
-
SHA1
7e373ef883563afef629690ce5dc2585ab9694b2
-
SHA256
af5e1bfe166b897cf4d89248ea0a326c36fd7e14fa339c15928f3709446654dd
-
SHA512
1912455ed0390264bddc73b2f0f8557905372f963cf99811f1ac81f96a36688fffa522130c8c0fd98f0e2d76fb8fac2de64a785a50eebce2bd9314a20852fd01
-
SSDEEP
49152:ErXYQ3DstxLgzpiOO9TJzfHeqytZ9G2DNf23mOp:cYQARAcOOXfHWZgYap
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource af5e1bfe166b897cf4d89248ea0a326c36fd7e14fa339c15928f3709446654dd
Files
-
af5e1bfe166b897cf4d89248ea0a326c36fd7e14fa339c15928f3709446654dd.exe windows:5 windows x86 arch:x86
248d3ad037fa07feb3a757d1aee71733
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
rtl100.bpl
@System@initialization$qqrv
@Sysconst@_SOperationAborted
@Types@Point$qqrii
@Sysutils@initialization$qqrv
@$xp$10ILockBytes
@Varutils@initialization$qqrv
@Variants@initialization$qqrv
@Typinfo@initialization$qqrv
@Classes@initialization$qqrv
@Math@NetPresentValue$qqrxgpxdxi17Math@TPaymentTime
@Contnrs@TOrderedList@$bctr$qqrv
@Helpintfs@initialization$qqrv
@Multimon@initialization$qqrv
@Inifiles@initialization$qqrv
@Registry@initialization$qqrv
@Syncobjs@TCriticalSection@Leave$qqrv
@Uxtheme@initialization$qqrv
@Dwmapi@initialization$qqrv
@Strutils@AnsiReplaceText$qqrx17System@AnsiStringt1t1
@Flatsb@initialization$qqrv
@Widestrings@initialization$qqrv
@Dateutils@EncodeDateTime$qqrxusxusxusxusxusxusxus
@Comobj@initialization$qqrv
@Mapi@initialization$qqrv
@Convutils@initialization$qqrv
@Zlib@DecompressBuf$qqrpxviirpvri
@Scktcomp@TAbstractSocket@Close$qqrv
@Objauto@ReleaseMethodPointer$qqrrx14System@TMethod
kernel32
TlsSetValue
WriteProcessMemory
Sleep
GetSystemTimeAsFileTime
GetModuleHandleA
LoadLibraryA
GetProcAddress
HeapAlloc
HeapFree
ExitProcess
user32
mouse_event
gdi32
SetTextColor
version
VerQueryValueA
ole32
CreateStreamOnHGlobal
vcl100.bpl
@Graphics@initialization$qqrv
@Stdctrls@TCustomListBox@LoadRecreateItems$qqrp16Classes@TStrings
@Printers@initialization$qqrv
@Graphutil@initialization$qqrv
@Extctrls@initialization$qqrv
@Dialogs@initialization$qqrv
@Clipbrd@initialization$qqrv
@Menus@initialization$qqrv
@Controls@initialization$qqrv
@Themes@initialization$qqrv
@Imglist@TCustomImageList@Draw$qqrp16Graphics@TCanvasiiio
@Actnlist@initialization$qqrv
@Forms@initialization$qqrv
@Buttons@initialization$qqrv
@Mask@TCustomMaskEdit@SetText$qqrx17System@AnsiString
@Extdlgs@initialization$qqrv
@Extactns@initialization$qqrv
@Comctrls@initialization$qqrv
@Olectrls@initialization$qqrv
@Axctrls@initialization$qqrv
@Olectnrs@initialization$qqrv
@Grids@TStringGrid@
@Oleserver@initialization$qqrv
shell32
ShellExecuteA
wsock32
WSACleanup
dbrtl100.bpl
@Fmtbcd@initialization$qqrv
@Sqltimst@initialization$qqrv
@Db@initialization$qqrv
bsfd2007.bpl
@Bsskinshellctrls@initialization$qqrv
@Bspngimage@initialization$qqrv
@Bszlib@initialization$qqrv
@Bsutils@initialization$qqrv
@Bseffects@initialization$qqrv
@Bsskintabs@TbsSkinTabControl@SetSkinData$qqrp22Bsskindata@TbsSkinData
@Bsskinctrls@TbsSkinSpeedButton@SetDown$qqro
@Bsskindata@TbsSkinListItems@GetItem$qqri
@Bsskinmenus@TbsSkinPopupMenu@
@Businessskinform@TbsBusinessSkinForm@SetSkinData$qqrp22Bsskindata@TbsSkinData
@Bsskinboxctrls@TbsSkinPasswordEdit@SetText$qqrx17System@AnsiString
@Bscalendar@initialization$qqrv
@Bscolorctrls@TbsSkinColorDialog@Execute$qqrv
@Bsmessages@initialization$qqrv
@Bsskingrids@TbsSkinStringGrid@
tmsd2007.bpl
@Advmenus@initialization$qqrv
@Advgdip@initialization$qqrv
@Advmenuutil@initialization$qqrv
@Advgroupbox@TAdvGroupBox@
vclactnband100.bpl
@Actnmenus@initialization$qqrv
@Actnman@initialization$qqrv
raizecomponentsvcl100.bpl
@Rzdtp@TRzDateTimePicker@
@Rzcommon@initialization$qqrv
@Rzpanel@TRzCustomPanel@$bctr$qqrp18Classes@TComponent
@Rzbutton@initialization$qqrv
@Rzcmbobx@initialization$qqrv
@Rzborder@initialization$qqrv
adortl100.bpl
@Adodb@initialization$qqrv
indysystem100.bpl
@Idsysvcl@initialization$qqrv
@Idglobal@initialization$qqrv
@Idbasecomponent@TIdBaseComponent@$bctr$qqrp18Classes@TComponent
@Idstack@initialization$qqrv
@Idwinsock2@initialization$qqrv
@Idwship6@initialization$qqrv
@Idstackwindows@initialization$qqrv
@Idcomponent@initialization$qqrv
indyprotocols100.bpl
@Idglobalprotocols@initialization$qqrv
@Idcharsets@initialization$qqrv
@Idhttp@initialization$qqrv
@Idauthentication@initialization$qqrv
@Idcodermime@initialization$qqrv
@Idcookie@initialization$qqrv
@Idssl@initialization$qqrv
fr7.bpl
@Frbarcod@initialization$qqrv
ehlib110.bpl
@Dbgrideh@initialization$qqrv
@Toolctrlseh@initialization$qqrv
@Propfilereh@initialization$qqrv
@Dbctrlseh@initialization$qqrv
@Gridseh@initialization$qqrv
@Dbutilseh@initialization$qqrv
@Dbgridehfinddlgs@initialization$qqrv
@Dbgridehimpexp@initialization$qqrv
vcldb100.bpl
@Dbpwdlg@initialization$qqrv
@Dblogdlg@initialization$qqrv
@Dbctrls@initialization$qqrv
@Dbgrids@TDBGrid@
vcljpg100.bpl
@Jpeg@initialization$qqrv
soaprtl100.bpl
@Encddecd@DecodeStream$qqrp15Classes@TStreamt1
indycore100.bpl
@Idiohandlerstack@initialization$qqrv
@Idiohandler@initialization$qqrv
@Idtcpclient@TIdTCPClientCustom@SetReadTimeout$qqrxi
@Idthread@initialization$qqrv
msvcrt
_gcvt
dsnap100.bpl
@Dbclient@initialization$qqrv
@Dsintf@initialization$qqrv
@Provider@initialization$qqrv
cxexteditorsd11.bpl
@Cxcheckcombobox@initialization$qqrv
@Cxexteditconsts@initialization$qqrv
@Cxsplitter@initialization$qqrv
cxlibraryd11.bpl
@Cxlookandfeelpainters@initialization$qqrv
@Cxgeometry@initialization$qqrv
@Cxgraphics@initialization$qqrv
@Cxclasses@initialization$qqrv
@Cxdrawtextutils@initialization$qqrv
@Cxcontrols@initialization$qqrv
@Cxlookandfeels@initialization$qqrv
@Cxcontainer@initialization$qqrv
@Cxdwmapi@initialization$qqrv
@Cxdateutils@initialization$qqrv
@Cxlibrarystrs@initialization$qqrv
@Cxformats@initialization$qqrv
@Cxstyles@initialization$qqrv
dxcored11.bpl
@Dxcore@initialization$qqrv
dxgdiplusd11.bpl
@Dxgdiplusapi@initialization$qqrv
@Dxgdiplusclasses@initialization$qqrv
dxthemed11.bpl
@Dxoffice11@initialization$qqrv
@Dxuxtheme@initialization$qqrv
@Dxthememanager@initialization$qqrv
cxdatad11.bpl
@Cxfilter@initialization$qqrv
@Cxfilterconsts@initialization$qqrv
@Cxdataconsts@initialization$qqrv
@Cxdatastorage@initialization$qqrv
@Cxcustomdata@initialization$qqrv
@Cxdbdata@initialization$qqrv
@Cxdbfilter@initialization$qqrv
cxeditorsd11.bpl
@Cxedit@initialization$qqrv
@Cxeditpaintutils@initialization$qqrv
@Cxeditutils@initialization$qqrv
@Cxeditconsts@initialization$qqrv
@Cxfiltercontrolstrs@initialization$qqrv
@Cxgroupbox@initialization$qqrv
@Cxcheckbox@initialization$qqrv
@Cxdropdownedit@initialization$qqrv
@Cxtextedit@initialization$qqrv
@Cxmaskedit@initialization$qqrv
@Cximagecombobox@initialization$qqrv
@Cxbuttons@TcxCustomButton@SetLookAndFeel$qqrp29Cxlookandfeels@TcxLookAndFeel
@Cxnavigator@initialization$qqrv
@Cxfiltercontrol@initialization$qqrv
@Cxeditdataregisteredrepositoryitems@initialization$qqrv
@Cxeditrepositoryitems@initialization$qqrv
@Cxradiogroup@initialization$qqrv
@Cxmruedit@initialization$qqrv
@Cxhyperlinkedit@initialization$qqrv
@Cxtimeedit@initialization$qqrv
@Cxspinedit@initialization$qqrv
@Cxcalc@initialization$qqrv
@Cxblobedit@initialization$qqrv
@Cxmemo@initialization$qqrv
@Cximage@initialization$qqrv
@Cxcurrencyedit@initialization$qqrv
@Cxcalendar@initialization$qqrv
@Cxbuttonedit@initialization$qqrv
@Cxeditdbregisteredrepositoryitems@initialization$qqrv
@Cxdbeditrepository@initialization$qqrv
@Cxdblookupcombobox@initialization$qqrv
@Cxinplacecontainer@initialization$qqrv
cxpagecontrold11.bpl
@Cxpc@initialization$qqrv
@Cxpcpaintersfactory@initialization$qqrv
@Cxpcconsts@initialization$qqrv
@Cxpcpainters@initialization$qqrv
anylib2007.bpl
@Anygrids@initialization$qqrv
@Anyolectnrs@initialization$qqrv
@Anymetafile@initialization$qqrv
@Gifimage_anylib@initialization$qqrv
@Anyscroll@initialization$qqrv
@Anydialogs@initialization$qqrv
@Anyrichedit@initialization$qqrv
@Fatexp@initialization$qqrv
@Designgrid@initialization$qqrv
@Inspector@initialization$qqrv
@Popuplb@initialization$qqrv
@Anyprint@initialization$qqrv
@Entitystyleform@initialization$qqrv
ibxpress100.bpl
@Ibcustomdataset@initialization$qqrv
@Ibintf@initialization$qqrv
@Ibutils@initialization$qqrv
@Ib@initialization$qqrv
@Ibsqlmonitor@initialization$qqrv
@Ibservices@initialization$qqrv
@Ibdatabase@initialization$qqrv
bdertl100.bpl
@Dbtables@initialization$qqrv
tee7100.bpl
@Teeconst@initialization$qqrv
@Teehtml@initialization$qqrv
@Tecanvas@initialization$qqrv
@Teeprocs@initialization$qqrv
@Teengine@initialization$qqrv
@Chart@initialization$qqrv
@Bubblech@initialization$qqrv
@Ganttch@initialization$qqrv
@Arrowcha@initialization$qqrv
@Teeshape@initialization$qqrv
vcliex100.bpl
@Shdocvw@CoInternetExplorer@Create$qqrp17System@TMetaClass
cxgridd11.bpl
@Cxgridlevel@TcxGridLevel@
@Cxgridcustomtableview@initialization$qqrv
@Cxgridcustomview@initialization$qqrv
@Cxgridcommon@initialization$qqrv
@Cxgridstrs@initialization$qqrv
@Cxgrid@initialization$qqrv
@Cxgridtableview@initialization$qqrv
@Cxgriddbtableview@initialization$qqrv
@Cxgriddbdatadefinitions@initialization$qqrv
@Cxgridbandedtableview@initialization$qqrv
voicecontrol32
VoiceControlSetRecvCallback
xmlrtl100.bpl
@Xmldoc@initialization$qqrv
@Msxmldom@initialization$qqrv
@Xmldom@initialization$qqrv
@Xmlintf@initialization$qqrv
@Xmlschema@initialization$qqrv
@Xmlschematags@initialization$qqrv
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 5KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 130KB - Virtual size: 130KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 4B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.txt0 Size: 549KB - Virtual size: 548KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.txt1 Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.txt2 Size: 303KB - Virtual size: 302KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ