CopieBaseReg[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

CopieBaseReg.exe
Size

244KB
MD5

a1aa4196b73a77216b1675a695aa812f
SHA1

ffce79b825bfedd1a8f2d8a4271a551c42430fb1
SHA256

36eb1bc25904a6c5f97491f893b157922ba3beb23f4b3b509ca34506349f6bc8
SHA512

7547abf603535696389319cd85e825dd9486d0bbd5e77c061e4ba3ab487c34e5734d7f7458b97c5580f9103332a84ccc8ea20985b8a58655bbe93b3f72c3b6d1
SSDEEP

3072:mbmb09Sf6PJDRlQSMMJvxyJhC2UkrSabh7e6ZAP07:2af6pRlQSM9CLeSabVp7

Score

1^/10

Malware Config

Signatures

Files

CopieBaseReg.exe
.exe windows:4 windows x86 arch:x86

5f9594cfeb4fe19624098fb014a8f12f

Code Sign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1c:4d:45:11:ab:4a:8f:b8:38:30:3f:1b
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

29/06/2020, 12:24

Not After

30/06/2023, 12:24

Subject

SERIALNUMBER=384054516,CN=CENTRE DE DEVELOPPEMENT DE L'INFORMATIQUE PERSONNELLE SAS,O=CENTRE DE DEVELOPPEMENT DE L'INFORMATIQUE PERSONNELLE SAS,STREET=10 Chaussee Jules Cesar,L=OSNY,ST=Ile-de-France,C=FR,1.3.6.1.4.1.311.60.2.1.3=#13024652,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:44

Not After

08/05/2033, 07:44

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20/02/2019, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

93:f2:69:1f:62:51:88:ae:86:14:25:f7:35:e3:ce:f1:4a:b2:45:09
Signer

Actual PE Digest

93:f2:69:1f:62:51:88:ae:86:14:25:f7:35:e3:ce:f1:4a:b2:45:09

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

rtl230.bpl

@System@initialization$qqrv
@System@Finalization$qqrv
@System@UTF8ToUnicodeString$qqrpxc
@System@FreeMemory$qpv
@System@@CheckAutoResult$qqrl
@System@UnregisterModule$qqrp17System@TLibModule
@System@RegisterModule$qqrp17System@TLibModule
@System@FindHInstance$qqrpv
@System@@DynArrayRelease$qqrpv
@System@@DynArrayAddRef$qqrpv
@System@SetAnsiString$qqrp27System@%AnsiStringT$us$i0$%pbius
@System@Pos$qqrx31System@%AnsiStringT$us$i65535$%t1i
@System@Pos$qqrx20System@UnicodeStringt1i
@System@@UStrCat3$qqrr20System@UnicodeStringx20System@UnicodeStringt2
@System@@UStrCat$qqrr20System@UnicodeStringx20System@UnicodeString
@System@@UStrFromLStr$qqrr20System@UnicodeStringx27System@%AnsiStringT$us$i0$%
@System@@UStrFromPChar$qqrr20System@UnicodeStringpc
@System@@WStrFromLStr$qqrr17System@WideStringx27System@%AnsiStringT$us$i0$%
@System@@LStrFromUStr$qqrr27System@%AnsiStringT$us$i0$%x20System@UnicodeStringus
@System@@LStrSetLength$qqrr27System@%AnsiStringT$us$i0$%ius
@System@@LStrInsert$qqrx27System@%AnsiStringT$us$i0$%r27System@%AnsiStringT$us$i0$%i
@System@@LStrDelete$qqrr27System@%AnsiStringT$us$i0$%ii
@System@@LStrCmp$qqrv
@System@@LStrCat3$qqrr27System@%AnsiStringT$us$i0$%x27System@%AnsiStringT$us$i0$%t2
@System@@LStrCat$qqrr27System@%AnsiStringT$us$i0$%x27System@%AnsiStringT$us$i0$%
@System@@LStrFromWStr$qqrr27System@%AnsiStringT$us$i0$%x17System@WideStringus
@System@@LStrFromArray$qqrr27System@%AnsiStringT$us$i0$%pcius
@System@@LStrFromPChar$qqrr27System@%AnsiStringT$us$i0$%pcus
@System@@LStrFromWChar$qqrr27System@%AnsiStringT$us$i0$%bus
@System@@LStrAsg$qqrr27System@%AnsiStringT$us$i0$%x27System@%AnsiStringT$us$i0$%
@System@@UStrAsg$qqrr20System@UnicodeStringx20System@UnicodeString
@System@@LStrFromPWCharLen$qqrr27System@%AnsiStringT$us$i0$%pbius
@System@@LStrClr$qqrpv
@System@@UStrClr$qqrpv
@System@@DoneExcept$qqrv
@System@@HandleFinally$qqrv
@System@@HandleAnyException$qqrv
@System@TObject@MethodName$qqrpv
@System@TObject@MethodAddress$qqrx20System@UnicodeString
@System@TObject@MethodAddress$qqrrx29System@%SmallString$uc$i255$%
@System@TObject@ClassInfo$qqrv
@System@TObject@InheritsFrom$qqrp17System@TMetaClass
@System@@FindDynaInst$qqrxp14System@TObjects
@System@TObject@UnitScope$qqrv
@System@TObject@UnitName$qqrv
@System@TObject@GetInterfaceTable$qqrv
@System@TObject@GetInterfaceEntry$qqrrx5_GUID
@System@TObject@InitInstance$qqrpv
@System@TObject@$bdtr$qqrv
@System@TObject@InstanceSize$qqrv
@System@TObject@ClassParent$qqrv
@System@TObject@ClassNameIs$qqrx20System@UnicodeString
@System@TObject@QualifiedClassName$qqrv
@System@TObject@ClassName$qqrv
@System@Set8087CW$qqrus
@System@Reset8087CW$qqrv
@System@SetRaiseList$qqrpv
@System@RaiseList$qqrv
@System@IsMemoryManagerSet$qqrv
@System@SetMemoryManager$qqrrx23System@TMemoryManagerEx
@System@DefaultSystemCodePage
@System@IsMultiThread
@System@IsConsole
@System@ExitProc
@System@CmdLine
@System@IsLibrary
@System@MainInstance
@System@ExceptionAcquired
@System@RaiseExceptObjProc
@System@ExceptObjProc
@System@Types@initialization$qqrv
@System@Types@Finalization$qqrv
@System@Uitypes@initialization$qqrv
@System@Uitypes@Finalization$qqrv
@System@Sysconst@initialization$qqrv
@System@Sysconst@Finalization$qqrv
@Winapi@Imagehlp@initialization$qqrv
@Winapi@Imagehlp@Finalization$qqrv
@Winapi@Shfolder@initialization$qqrv
@Winapi@Shfolder@Finalization$qqrv
@System@Rtlconsts@initialization$qqrv
@System@Rtlconsts@Finalization$qqrv
@System@Character@initialization$qqrv
@System@Character@Finalization$qqrv
@System@Internal@Excutils@initialization$qqrv
@System@Internal@Excutils@Finalization$qqrv
@System@Sysutils@initialization$qqrv
@System@Sysutils@Finalization$qqrv
@System@Sysutils@TOSVersion@$bcctr$qqrv
@System@Sysutils@TEncoding@$bcdtr$qqrv
@System@Sysutils@SafeLoadLibrary$qqrx20System@UnicodeStringui
@System@Sysutils@TLanguages@$bcdtr$qqrv
@System@Sysutils@Exception@$bcdtr$qqrv
@System@Sysutils@Exception@$bcctr$qqrv
@System@Sysutils@Exception@$bdtr$qqrv
@System@Sysutils@Exception@$bctr$qqrx20System@UnicodeString
@System@Sysutils@FileExists$qqrx20System@UnicodeStringo
@System@Sysutils@TOSVersion@$bcdtr$qqrv
@System@Sysutils@TEncoding@$bcctr$qqrv
@System@Sysutils@Exception@
@System@Sysutils@TLanguages@$bcctr$qqrv
@System@Math@initialization$qqrv
@System@Math@Finalization$qqrv
@System@Varutils@initialization$qqrv
@System@Varutils@Finalization$qqrv
@System@Variants@initialization$qqrv
@System@Variants@Finalization$qqrv
@System@Strutils@initialization$qqrv
@System@Strutils@Finalization$qqrv
@System@Strutils@ReplaceStr$qqrx20System@UnicodeStringt1t1
@System@Ansistrings@initialization$qqrv
@System@Ansistrings@Finalization$qqrv
@System@Hash@initialization$qqrv
@System@Hash@Finalization$qqrv
@System@Generics@Defaults@initialization$qqrv
@System@Generics@Defaults@Finalization$qqrv
@System@Generics@Defaults@TIStringComparer@$bcdtr$qqrv
@System@Generics@Defaults@TStringComparer@$bcdtr$qqrv
@System@Generics@Defaults@TIStringComparer@$bcctr$qqrv
@System@Generics@Defaults@TStringComparer@$bcctr$qqrv
@System@Generics@Collections@initialization$qqrv
@System@Generics@Collections@Finalization$qqrv
@System@Rtti@initialization$qqrv
@System@Rtti@Finalization$qqrv
@System@Rtti@TRttiContext@$bcdtr$qqrv
@System@Rtti@TRttiContext@$bcctr$qqrv
@System@Typinfo@initialization$qqrv
@System@Typinfo@Finalization$qqrv
@System@Classes@initialization$qqrv
@System@Classes@Finalization$qqrv
@System@Classes@TBaseAsyncResult@$bcdtr$qqrv
@System@Classes@TBaseAsyncResult@$bcctr$qqrv
@System@Classes@TObserverMapping@$bcdtr$qqrv
@System@Classes@TLoginCredentialService@$bcdtr$qqrv
@System@Classes@TLoginCredentialService@$bcctr$qqrv
@System@Classes@TBinaryWriter@$bcdtr$qqrv
@System@Classes@TComponent@$bcctr$qqrv
@System@Classes@TThread@$bcdtr$qqrv
@System@Classes@TThread@$bcctr$qqrv
@System@Classes@TStringList@$bctr$qqrv
@System@Classes@TStringList@$bdtr$qqrv
@System@Classes@TStrings@$bdtr$qqrv
@System@Classes@TPersistent@$bdtr$qqrv
@System@Classes@TBinaryWriter@$bcctr$qqrv
@System@Classes@TComponent@$bcdtr$qqrv
@System@Classes@TObserverMapping@$bcctr$qqrv
@System@Classes@TStringList@
@System@Uiconsts@initialization$qqrv
@System@Uiconsts@Finalization$qqrv
@System@Actions@initialization$qqrv
@System@Actions@Finalization$qqrv
@System@Timespan@initialization$qqrv
@System@Timespan@Finalization$qqrv
@System@Timespan@TTimeSpan@$bcctr$qqrv
@System@Timespan@TTimeSpan@$bcdtr$qqrv
@System@Diagnostics@initialization$qqrv
@System@Diagnostics@Finalization$qqrv
@System@Syncobjs@initialization$qqrv
@System@Syncobjs@Finalization$qqrv
@System@Syncobjs@TInterlocked@Increment$qqrri
@System@Win@Comconst@initialization$qqrv
@System@Win@Comconst@Finalization$qqrv
@System@Win@Comobj@initialization$qqrv
@System@Win@Comobj@Finalization$qqrv
@System@Win@Comobj@TComServerObject@$bcctr$qqrv
@System@Win@Comobj@TComServerObject@$bcdtr$qqrv
@System@Contnrs@initialization$qqrv
@System@Contnrs@Finalization$qqrv
@System@Dateutils@initialization$qqrv
@System@Dateutils@Finalization$qqrv
@System@Dateutils@TTimeZone@$bcdtr$qqrv
@System@Dateutils@TTimeZone@$bcctr$qqrv
@System@Masks@initialization$qqrv
@System@Masks@Finalization$qqrv
@System@Ioutils@initialization$qqrv
@System@Ioutils@Finalization$qqrv
@System@Ioutils@TPath@$bcctr$qqrv
@System@Ioutils@TPath@$bcdtr$qqrv
@System@Inifiles@initialization$qqrv
@System@Inifiles@Finalization$qqrv
@System@Win@Registry@initialization$qqrv
@System@Win@Registry@Finalization$qqrv
@System@Win@Registry@TRegistry@KeyExists$qqrx20System@UnicodeString
@System@Win@Registry@TRegistry@ValueExists$qqrx20System@UnicodeString
@System@Win@Registry@TRegistry@ReadInteger$qqrx20System@UnicodeString
@System@Win@Registry@TRegistry@WriteInteger$qqrx20System@UnicodeStringi
@System@Win@Registry@TRegistry@ReadString$qqrx20System@UnicodeString
@System@Win@Registry@TRegistry@WriteExpandString$qqrx20System@UnicodeStringt1
@System@Win@Registry@TRegistry@WriteString$qqrx20System@UnicodeStringt1
@System@Win@Registry@TRegistry@GetDataType$qqrx20System@UnicodeString
@System@Win@Registry@TRegistry@GetValueNames$qqrp23System@Classes@TStrings
@System@Win@Registry@TRegistry@GetKeyNames$qqrp23System@Classes@TStrings
@System@Win@Registry@TRegistry@OpenKey$qqrx20System@UnicodeStringo
@System@Win@Registry@TRegistry@SetRootKey$qqrp6HKEY__
@System@Win@Registry@TRegistry@$bdtr$qqrv
@System@Win@Registry@TRegistry@$bcctr$qqrv
@System@Win@Registry@TRegistry@$bctr$qqrui
@System@Win@Registry@TRegistry@
@System@Win@Registry@TRegistry@$bcdtr$qqrv
@System@Helpintfs@initialization$qqrv
@System@Helpintfs@Finalization$qqrv
@Winapi@Msxmlintf@initialization$qqrv
@Winapi@Msxmlintf@Finalization$qqrv
@Winapi@Uxtheme@initialization$qqrv
@Winapi@Uxtheme@Finalization$qqrv
@Winapi@Flatsb@initialization$qqrv
@Winapi@Flatsb@Finalization$qqrv
@Winapi@Multimon@initialization$qqrv
@Winapi@Multimon@Finalization$qqrv
@System@Widestrutils@initialization$qqrv
@System@Widestrutils@Finalization$qqrv
@System@Zlib@initialization$qqrv
@System@Zlib@Finalization$qqrv
@System@Internal@Debugutils@initialization$qqrv
@System@Internal@Debugutils@Finalization$qqrv
@System@Internal@Debugutils@TDebugUtils@$bcdtr$qqrv
@System@Internal@Debugutils@TDebugUtils@$bcctr$qqrv
@Winapi@Wincodec@initialization$qqrv
@Winapi@Wincodec@Finalization$qqrv
@System@Messaging@initialization$qqrv
@System@Messaging@Finalization$qqrv
@System@Messaging@TMessageManager@$bcdtr$qqrv
@System@Messaging@TMessageManager@$bcctr$qqrv
@System@Netconsts@initialization$qqrv
@System@Netconsts@Finalization$qqrv
@System@Win@Bluetooth@initialization$qqrv
@System@Win@Bluetooth@Finalization$qqrv
@System@Win@Bluetooth@TWinBluetoothSocket@$bcdtr$qqrv
@System@Win@Bluetooth@TWinBluetoothSocket@$bcctr$qqrv
@System@Bluetooth@initialization$qqrv
@System@Bluetooth@Finalization$qqrv
@System@Bluetooth@TBluetoothLEManager@$bcdtr$qqrv
@System@Bluetooth@TBluetoothLEManager@$bcctr$qqrv
@System@Bluetooth@TBluetoothManager@$bcdtr$qqrv
@System@Bluetooth@TBluetoothManager@$bcctr$qqrv
@System@Win@Beacon@initialization$qqrv
@System@Win@Beacon@Finalization$qqrv
@System@Beacon@initialization$qqrv
@System@Beacon@Finalization$qqrv
@System@Win@Taskbar@initialization$qqrv
@System@Win@Taskbar@Finalization$qqrv
@System@Win@Taskbarcore@initialization$qqrv
@System@Win@Taskbarcore@Finalization$qqrv
@System@Imagelist@initialization$qqrv
@System@Imagelist@Finalization$qqrv

vcl230.bpl

@Vcl@Consts@initialization$qqrv
@Vcl@Consts@Finalization$qqrv
@Vcl@Graphics@initialization$qqrv
@Vcl@Graphics@Finalization$qqrv
@Vcl@Graphics@TWICImage@$bcdtr$qqrv
@Vcl@Graphics@TWICImage@$bcctr$qqrv
@Vcl@Actnlist@initialization$qqrv
@Vcl@Actnlist@Finalization$qqrv
@Vcl@Graphutil@initialization$qqrv
@Vcl@Graphutil@Finalization$qqrv
@Vcl@Controls@initialization$qqrv
@Vcl@Controls@Finalization$qqrv
@Vcl@Stdctrls@initialization$qqrv
@Vcl@Stdctrls@Finalization$qqrv
@Vcl@Stdctrls@TStaticText@$bcdtr$qqrv
@Vcl@Stdctrls@TStaticText@$bcctr$qqrv
@Vcl@Stdctrls@TListBox@$bcdtr$qqrv
@Vcl@Stdctrls@TListBox@$bcctr$qqrv
@Vcl@Stdctrls@TCheckBox@$bcdtr$qqrv
@Vcl@Stdctrls@TCheckBox@$bcctr$qqrv
@Vcl@Stdctrls@TButton@$bcdtr$qqrv
@Vcl@Stdctrls@TButton@$bcctr$qqrv
@Vcl@Stdctrls@TComboBox@$bcdtr$qqrv
@Vcl@Stdctrls@TComboBox@$bcctr$qqrv
@Vcl@Stdctrls@TMemo@$bcdtr$qqrv
@Vcl@Stdctrls@TMemo@$bcctr$qqrv
@Vcl@Stdctrls@TEdit@$bcdtr$qqrv
@Vcl@Stdctrls@TEdit@$bcctr$qqrv
@Vcl@Stdctrls@TGroupBox@$bcdtr$qqrv
@Vcl@Stdctrls@TGroupBox@$bcctr$qqrv
@Vcl@Stdctrls@TCustomStaticText@$bcdtr$qqrv
@Vcl@Stdctrls@TCustomStaticText@$bcctr$qqrv
@Vcl@Stdctrls@TScrollBar@$bcdtr$qqrv
@Vcl@Stdctrls@TScrollBar@$bcctr$qqrv
@Vcl@Stdctrls@TCustomListBox@$bcdtr$qqrv
@Vcl@Stdctrls@TCustomListBox@$bcctr$qqrv
@Vcl@Stdctrls@TRadioButton@$bcdtr$qqrv
@Vcl@Stdctrls@TRadioButton@$bcctr$qqrv
@Vcl@Stdctrls@TCustomCheckBox@$bcdtr$qqrv
@Vcl@Stdctrls@TCustomCheckBox@$bcctr$qqrv
@Vcl@Stdctrls@TCustomButton@$bcdtr$qqrv
@Vcl@Stdctrls@TCustomButton@$bcctr$qqrv
@Vcl@Stdctrls@TCustomComboBox@$bcdtr$qqrv
@Vcl@Stdctrls@TCustomComboBox@$bcctr$qqrv
@Vcl@Stdctrls@TCustomMemo@$bcdtr$qqrv
@Vcl@Stdctrls@TCustomMemo@$bcctr$qqrv
@Vcl@Stdctrls@TCustomEdit@$bcdtr$qqrv
@Vcl@Stdctrls@TCustomEdit@$bcctr$qqrv
@Vcl@Stdctrls@TCustomGroupBox@$bcdtr$qqrv
@Vcl@Stdctrls@TCustomGroupBox@$bcctr$qqrv
@Vcl@Printers@initialization$qqrv
@Vcl@Printers@Finalization$qqrv
@Vcl@Toolwin@initialization$qqrv
@Vcl@Toolwin@Finalization$qqrv
@Vcl@Listactns@initialization$qqrv
@Vcl@Listactns@Finalization$qqrv
@Vcl@Comstrs@initialization$qqrv
@Vcl@Comstrs@Finalization$qqrv
@Vcl@Stdactns@initialization$qqrv
@Vcl@Stdactns@Finalization$qqrv
@Vcl@Comctrls@initialization$qqrv
@Vcl@Comctrls@Finalization$qqrv
@Vcl@Comctrls@THeaderControl@$bcdtr$qqrv
@Vcl@Comctrls@THeaderControl@$bcctr$qqrv
@Vcl@Comctrls@TStatusBar@$bcdtr$qqrv
@Vcl@Comctrls@TStatusBar@$bcctr$qqrv
@Vcl@Comctrls@TComboBoxEx@$bcdtr$qqrv
@Vcl@Comctrls@TComboBoxEx@$bcctr$qqrv
@Vcl@Comctrls@TCustomComboBoxEx@$bcdtr$qqrv
@Vcl@Comctrls@TCustomComboBoxEx@$bcctr$qqrv
@Vcl@Comctrls@TPageScroller@$bcdtr$qqrv
@Vcl@Comctrls@TPageScroller@$bcctr$qqrv
@Vcl@Comctrls@TDateTimePicker@$bcdtr$qqrv
@Vcl@Comctrls@TDateTimePicker@$bcctr$qqrv
@Vcl@Comctrls@TCoolBar@$bcdtr$qqrv
@Vcl@Comctrls@TCoolBar@$bcctr$qqrv
@Vcl@Comctrls@TToolBar@$bcdtr$qqrv
@Vcl@Comctrls@TToolBar@$bcctr$qqrv
@Vcl@Comctrls@TListView@$bcdtr$qqrv
@Vcl@Comctrls@TListView@$bcctr$qqrv
@Vcl@Comctrls@TCustomListView@$bcdtr$qqrv
@Vcl@Comctrls@TCustomListView@$bcctr$qqrv
@Vcl@Comctrls@THotKey@$bcdtr$qqrv
@Vcl@Comctrls@THotKey@$bcctr$qqrv
@Vcl@Comctrls@TCustomHotKey@$bcdtr$qqrv
@Vcl@Comctrls@TCustomHotKey@$bcctr$qqrv
@Vcl@Comctrls@TUpDown@$bcdtr$qqrv
@Vcl@Comctrls@TUpDown@$bcctr$qqrv
@Vcl@Comctrls@TCustomUpDown@$bcdtr$qqrv
@Vcl@Comctrls@TCustomUpDown@$bcctr$qqrv
@Vcl@Comctrls@TRichEdit@$bcdtr$qqrv
@Vcl@Comctrls@TRichEdit@$bcctr$qqrv
@Vcl@Comctrls@TCustomRichEdit@$bcdtr$qqrv
@Vcl@Comctrls@TCustomRichEdit@$bcctr$qqrv
@Vcl@Comctrls@TProgressBar@$bcdtr$qqrv
@Vcl@Comctrls@TProgressBar@$bcctr$qqrv
@Vcl@Comctrls@TTrackBar@$bcdtr$qqrv
@Vcl@Comctrls@TTrackBar@$bcctr$qqrv
@Vcl@Comctrls@TTreeView@$bcdtr$qqrv
@Vcl@Comctrls@TTreeView@$bcctr$qqrv
@Vcl@Comctrls@TCustomTreeView@$bcdtr$qqrv
@Vcl@Comctrls@TCustomTreeView@$bcctr$qqrv
@Vcl@Comctrls@TCustomHeaderControl@$bcdtr$qqrv
@Vcl@Comctrls@TCustomHeaderControl@$bcctr$qqrv
@Vcl@Comctrls@TCustomStatusBar@$bcdtr$qqrv
@Vcl@Comctrls@TCustomStatusBar@$bcctr$qqrv
@Vcl@Comctrls@TTabControl@$bcdtr$qqrv
@Vcl@Comctrls@TTabControl@$bcctr$qqrv
@Vcl@Comctrls@TCustomTabControl@$bcdtr$qqrv
@Vcl@Comctrls@TCustomTabControl@$bcctr$qqrv
@Vcl@Dialogs@initialization$qqrv
@Vcl@Dialogs@Finalization$qqrv
@Vcl@Extctrls@initialization$qqrv
@Vcl@Extctrls@Finalization$qqrv
@Vcl@Extctrls@TLinkLabel@$bcdtr$qqrv
@Vcl@Extctrls@TLinkLabel@$bcctr$qqrv
@Vcl@Extctrls@TCustomLinkLabel@$bcdtr$qqrv
@Vcl@Extctrls@TCustomLinkLabel@$bcctr$qqrv
@Vcl@Extctrls@TCategoryPanelGroup@$bcdtr$qqrv
@Vcl@Extctrls@TCategoryPanelGroup@$bcctr$qqrv
@Vcl@Extctrls@TCustomCategoryPanelGroup@$bcdtr$qqrv
@Vcl@Extctrls@TCustomCategoryPanelGroup@$bcctr$qqrv
@Vcl@Themes@initialization$qqrv
@Vcl@Themes@Finalization$qqrv
@Vcl@Themes@TCustomStyleEngine@$bcdtr$qqrv
@Vcl@Themes@TCustomStyleEngine@$bcctr$qqrv
@Vcl@Themes@TStyleManager@$bcctr$qqrv
@Vcl@Themes@TStyleManager@$bcdtr$qqrv
@Vcl@Imglist@initialization$qqrv
@Vcl@Imglist@Finalization$qqrv
@Vcl@Menus@initialization$qqrv
@Vcl@Menus@Finalization$qqrv
@Vcl@Forms@initialization$qqrv
@Vcl@Forms@Finalization$qqrv
@Vcl@Forms@TApplication@SetMainFormOnTaskBar$qqrxo
@Vcl@Forms@TApplication@ShowException$qqrp25System@Sysutils@Exception
@Vcl@Forms@TApplication@Run$qqrv
@Vcl@Forms@TApplication@Initialize$qqrv
@Vcl@Forms@TForm@$bcdtr$qqrv
@Vcl@Forms@TForm@$bcctr$qqrv
@Vcl@Forms@TCustomForm@$bcdtr$qqrv
@Vcl@Forms@TCustomForm@$bcctr$qqrv
@Vcl@Forms@TScrollBox@$bcdtr$qqrv
@Vcl@Forms@TScrollBox@$bcctr$qqrv
@Vcl@Forms@Application
@Vcl@Clipbrd@initialization$qqrv
@Vcl@Clipbrd@Finalization$qqrv

borlndmm

GetAllocMemCount
__dbk_fcall_wrapper

kernel32

CopyFileW
FreeLibrary
GetCommandLineW
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetVersionExW
HeapAlloc
HeapFree
InterlockedExchange
LoadLibraryA
LocalAlloc
LocalFree
RaiseException

cc32230mt

@$bdele$qpv
@_CatchCleanup$qv
@_InitTermAndUnexPtrs$qv
@_ThrowExceptionLDTC$qpvt1t1t1uiuiuipuct1
@__exceptionAcquired
@setExceptionFuncAddr$qpqp17_EXCEPTION_RECORDpp4tpid$pvppqqrp17_EXCEPTION_RECORD$v
@setRaiseListFuncAddr$qpvt1
__ErrorExit
___CRTL_MEM_GetBorMemPtrs
___CRTL_MEM_UseBorMM
___CRTL_TLS_Alloc
___CRTL_TLS_ExitThread
___CRTL_TLS_Free
___CRTL_TLS_GetValue
___CRTL_TLS_InitThread
___CRTL_TLS_SetValue
___CRTL_VCL_FPU_Hook
___VCL_add_EH
___VCL_clear_EH
___VCL_init_except
___VCL_init_fpu
____ExceptionHandler
___getExceptionObject
__argc
__argv
__argv_default_expand
__exitargv
__handle_exitargv
__handle_setargv
__handle_wexitargv
__handle_wsetargv
__matherr
__matherrl
__setargv
__startup
__wargv_default_expand
_memcpy

Exports

Exports

__GetExceptDLLinfo
___CPPdebugHook
__dbk_fcall_wrapper
__dbk_fcall_wrapper
__dbk_fcall_wrapper_addr
__stkchk
dbkFCallWrapperAddr

Sections

.text
Size: 26KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 170KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5f9594cfeb4fe19624098fb014a8f12f

Code Sign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0fCertificate

Extended Key Usages

Key Usages

1c:4d:45:11:ab:4a:8f:b8:38:30:3f:1bCertificate

Extended Key Usages

Key Usages

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1dCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fcCertificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

93:f2:69:1f:62:51:88:ae:86:14:25:f7:35:e3:ce:f1:4a:b2:45:09Signer

Headers

File Characteristics

Imports

rtl230.bpl

vcl230.bpl

borlndmm

kernel32

cc32230mt

Exports

Exports

Sections

.text Size: 26KB - Virtual size: 28KB

.data Size: 7KB - Virtual size: 8KB

.tls Size: 512B - Virtual size: 4KB

.rdata Size: 512B - Virtual size: 4KB

.idata Size: 24KB - Virtual size: 24KB

.edata Size: 512B - Virtual size: 4KB

.rsrc Size: 170KB - Virtual size: 172KB

.reloc Size: 4KB - Virtual size: 4KB

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

1c:4d:45:11:ab:4a:8f:b8:38:30:3f:1b
Certificate

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

93:f2:69:1f:62:51:88:ae:86:14:25:f7:35:e3:ce:f1:4a:b2:45:09
Signer

.text
Size: 26KB - Virtual size: 28KB

.data
Size: 7KB - Virtual size: 8KB

.tls
Size: 512B - Virtual size: 4KB

.rdata
Size: 512B - Virtual size: 4KB

.idata
Size: 24KB - Virtual size: 24KB

.edata
Size: 512B - Virtual size: 4KB

.rsrc
Size: 170KB - Virtual size: 172KB

.reloc
Size: 4KB - Virtual size: 4KB