c24b313ee90336035a52ab204ff6d42d472eb7a2ae7b637d81454715c87bb400

Sharing

Copy URL Twitter E-mail

General

Target

c24b313ee90336035a52ab204ff6d42d472eb7a2ae7b637d81454715c87bb400
Size

70KB
MD5

78e694664105ef1467c5cb9938d0d44f
SHA1

fad105f0b2130c22dfa6b9af495c990901ac6245
SHA256

c24b313ee90336035a52ab204ff6d42d472eb7a2ae7b637d81454715c87bb400
SHA512

cdbcba9afe731d05009fb433d8ea623fb3ff8934e1e48b072fcddb37764520f75200baa2d61bdf5e60a72dc124e473e28ea262064568318899afe75f5922b634
SSDEEP

1536:LGkh3g31CzQhO/pP2lqVJ9KMF3V/uuSgMPX7xlrWe7GO:Lu3Kp/eqVJ9KMF3VYPX7xlrWe7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c24b313ee90336035a52ab204ff6d42d472eb7a2ae7b637d81454715c87bb400

Files

c24b313ee90336035a52ab204ff6d42d472eb7a2ae7b637d81454715c87bb400
.dll windows:5 windows x86 arch:x86

ec19f0f00fe3527e8da88373f08d8d4f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetLastError
GetProcAddress
TlsGetValue
LocalFree
TlsAlloc
TlsSetValue
GetVersionExW
FreeLibrary
LoadLibraryA
LocalAlloc
RaiseException
TlsFree

rtl260.bpl

@System@Sysutils@Finalization$qqrv
@System@Varutils@Finalization$qqrv
@System@Rtti@TRttiContext@$bcdtr$qqrv
@System@TObject@Dispatch$qqrpv
@System@@UStrCopy$qqrx20System@UnicodeStringii
@System@Variants@Finalization$qqrv
@System@Classes@TThread@$bcctr$qqrv
@System@TObject@ToString$qqrv
@System@Classes@TThread@$bcdtr$qqrv
@System@Classes@TLoginCredentialService@$bcctr$qqrv
@System@Uiconsts@initialization$qqrv
@System@Classes@TLoginCredentialService@$bcdtr$qqrv
@Winapi@Uxtheme@initialization$qqrv
@System@Syncobjs@Finalization$qqrv
@System@Messaging@TMessageManager@$bcctr$qqrv
@System@TObject@Free$qqrv
@System@Messaging@TMessageManager@$bcdtr$qqrv
@System@RegisterModule$qqrp17System@TLibModule
@System@Sysutils@FormatDateTime$qqrx20System@UnicodeString16System@TDateTime
@System@@RunError$qqruc
@System@Classes@TBinaryWriter@$bcctr$qqrv
@System@Win@Comobj@initialization$qqrv
@System@Classes@TBinaryWriter@$bcdtr$qqrv
@System@StringOfChar$qqrbi
@Winapi@Uxtheme@Finalization$qqrv
@System@Sysutils@TIntegerHelper@ToString$qqrv
@System@initialization$qqrv
@System@Classes@TComponent@$bcctr$qqrv
@System@TObject@DefaultHandler$qqrpv
@System@Classes@TComponent@$bcdtr$qqrv
@System@Generics@Defaults@TIStringComparer@$bcctr$qqrv
@System@Classes@Finalization$qqrv
@System@Generics@Defaults@TIStringComparer@$bcdtr$qqrv
@System@Timespan@TTimeSpan@$bcctr$qqrv
@System@TObject@BeforeDestruction$qqrv
@System@Typinfo@initialization$qqrv
@System@Uiconsts@Finalization$qqrv
@System@Timespan@TTimeSpan@$bcdtr$qqrv
@System@@CopyRecord$qqrv
@$xp$13System@string
@System@@UStrToPWChar$qqrx20System@UnicodeString
@System@@UStrEqual$qqrv
@System@Classes@TBaseAsyncResult@$bcctr$qqrv
@System@Math@initialization$qqrv
@System@Classes@TBaseAsyncResult@$bcdtr$qqrv
@System@@PackageLoad$qqrxp23System@PackageInfoTablep17System@TLibModule
@System@Helpintfs@Finalization$qqrv
@System@@UStrArrayClr$qqrpvi
@System@Sysutils@TLanguages@$bcctr$qqrv
@System@Sysutils@SafeLoadLibrary$qqrx20System@UnicodeStringui
@System@Sysutils@TEncoding@$bcctr$qqrv
@System@Ansistrings@initialization$qqrv
@System@TObject@GetHashCode$qqrv
@System@Sysutils@TLanguages@$bcdtr$qqrv
@System@Sysutils@TEncoding@$bcdtr$qqrv
@System@Classes@TObserverMapping@$bcctr$qqrv
@Winapi@Flatsb@initialization$qqrv
@System@Sysutils@ExtractFilePath$qqrx20System@UnicodeString
@System@Classes@TObserverMapping@$bcdtr$qqrv
@System@Classes@TFieldsCache@$bcctr$qqrv
@System@Classes@TFieldsCache@$bcdtr$qqrv
@Winapi@Flatsb@Finalization$qqrv
@System@Variants@initialization$qqrv
@System@TObject@Equals$qqrp14System@TObject
@System@Rtti@initialization$qqrv
@$xp$14System@TObject
@$xp$11System@Word
@System@Win@Comobj@Finalization$qqrv
@System@Sysutils@IntToStr$qqri
@System@Uitypes@initialization$qqrv
@System@Dateutils@initialization$qqrv
@System@TObject@FreeInstance$qqrv
@System@TObject@SafeCallException$qqrp14System@TObjectpv
@System@Classes@initialization$qqrv
@System@@HandleAnyException$qqrv
@System@Sysutils@Exception@$bcctr$qqrv
@System@TObject@$bdtr$qqrv
@System@Win@Comobj@TComServerObject@$bcctr$qqrv
@System@Varutils@initialization$qqrv
@System@Sysutils@Exception@$bcdtr$qqrv
@System@Character@Finalization$qqrv
@System@Win@Comobj@TComServerObject@$bcdtr$qqrv
@System@Internal@Excutils@initialization$qqrv
@System@Sysutils@initialization$qqrv
@System@Inifiles@Finalization$qqrv
@System@@HandleFinally$qqrv
@System@ParamStr$qqri
@System@TObject@NewInstance$qqrv
@System@Math@Finalization$qqrv
@System@Pos$qqrx20System@UnicodeStringt1i
@System@Dateutils@Finalization$qqrv
@System@TObject@
@$xp$26System@Classes@TStringList
@System@Character@initialization$qqrv
@System@Sysutils@TOSVersion@$bcctr$qqrv
@System@Inifiles@initialization$qqrv
@System@Sysutils@TOSVersion@$bcdtr$qqrv
@System@Ansistrings@Finalization$qqrv
@System@@FinalizeRecord$qqrpvt1
@System@@UStrAsg$qqrr20System@UnicodeStringx20System@UnicodeString
@System@@DoneExcept$qqrv
@System@Sysutils@EncodeDate$qqrususus
@System@Generics@Defaults@TStringComparer@$bcctr$qqrv
@System@Generics@Defaults@TStringComparer@$bcdtr$qqrv
@System@@UStrCatN$qqrv
@System@Helpintfs@initialization$qqrv
@System@Rtti@Finalization$qqrv
@System@@UStrClr$qqrpv
@System@Internal@Excutils@Finalization$qqrv
@System@Actions@initialization$qqrv
@System@Typinfo@Finalization$qqrv
@System@@PackageUnload$qqrxp23System@PackageInfoTablep17System@TLibModule
@System@TObject@AfterConstruction$qqrv
@System@LoadResString$qqrp20System@TResStringRec
@System@Syncobjs@initialization$qqrv
@$xp$7Integer
@System@Finalization$qqrv
@System@Ioutils@TPath@$bcctr$qqrv
@System@Ioutils@TPath@$bcdtr$qqrv
@System@@UStrAddRef$qqrpv
@System@Win@Registry@TRegistry@$bcctr$qqrv
@System@Win@Registry@TRegistry@$bcdtr$qqrv
@System@Sysutils@ExtractFileName$qqrx20System@UnicodeString
@System@@UStrCat3$qqrr20System@UnicodeStringx20System@UnicodeStringt2
@System@Dateutils@TTimeZone@$bcctr$qqrv
@System@Uitypes@Finalization$qqrv
@System@Actions@Finalization$qqrv
@System@Sysutils@Format$qqrx20System@UnicodeStringpx14System@TVarRecxi
@System@Dateutils@TTimeZone@$bcdtr$qqrv
@System@UnregisterModule$qqrp17System@TLibModule
@System@Rtti@TRttiContext@$bcctr$qqrv

bplussharemsc.bpl

@Bwin32@TBplusWin32@MyComputerName$qqrv
@Bregistry@TBplusRegistry@GetGuid$qqrv
@Bregistry@TBplusRegistry@ReadRegistryString$qqrx20System@UnicodeStringt1t1t1
@$xp$33Bfileversioninfo@TFileVersionInfo
@Bfileversioninfo@BplusFileVersionInfo
@Bwin32@TBplusWin32@SysYearOffset$qqrv
@Bregistry@TBplusRegistry@ReadLocalOverrides$qqrv
@Bregistry@TBplusRegistry@WriteRegistryString$qqrx20System@UnicodeStringt1t1t1
@Bfileversioninfo@TBplusFileVersionInfo@GetAllVersionInfo$qqrx20System@UnicodeString
@Bwin32@TBplusWin32@GetAllUserAppDataPath$qqrv
@Bwin32@BplusWin32
@Bregistry@BplusRegistry

dbrtl260.bpl

@Data@Db@TDataSet@Next$qqrv
@Data@Db@TDataSet@First$qqrv
@Data@Db@TDataSet@Open$qqrv
@Data@Fmtbcd@Finalization$qqrv
@Data@Db@TDataSet@FindField$qqrx20System@UnicodeString
@Data@Fmtbcd@initialization$qqrv
@Data@Sqltimst@initialization$qqrv
@Data@Db@TDataSet@FieldByName$qqrx20System@UnicodeString
@Data@Sqltimst@Finalization$qqrv
@Data@Db@TDataSet@Close$qqrv
@Data@Db@initialization$qqrv
@Data@Db@Finalization$qqrv

user32

RegisterWindowMessageW

firedac260.bpl

@Firedac@Comp@Client@Finalization$qqrv
@Firedac@Comp@Client@TFDCustomManager@$bcctr$qqrv
@Firedac@Comp@Client@TFDCustomManager@$bcdtr$qqrv
@Firedac@Comp@Client@TFDCustomQuery@GetSQL$qqrv
@Firedac@Comp@Client@TFDCustomQuery@$bctr$qqrp25System@Classes@TComponent
@Firedac@Comp@Client@TFDRdbmsDataSet@SetConnection$qqrxp39Firedac@Comp@Client@TFDCustomConnection
@Firedac@Comp@Client@initialization$qqrv
@Firedac@Comp@Client@TFDCustomMemTable@$bctr$qqrp25System@Classes@TComponent
@Firedac@Comp@Client@TFDMemTable@
@$xp$33Firedac@Comp@Client@TFDConnection
@Firedac@Comp@Dataset@TFDDataSet@LoadFromFile$qqrx20System@UnicodeString34Firedac@Stan@Intf@TFDStorageFormat
@Firedac@Comp@Client@TFDQuery@

bplusfiredacsys.bpl

@Bfiredacconf@BplusFiredacConf
@Bfiredacconf@TBplusFiredacConf@GetFdcFileName$qqrx20System@UnicodeStringt1
@Bfiredacconf@TBplusFiredacConf@GetFdcUserName$qqrx20System@UnicodeStringt1
@Bfiredacconf@TBplusFiredacConf@GetFdcPassword$qqrx20System@UnicodeStringt1
@Bfiredacconf@TBplusFiredacConf@GetFdcDriverName$qqrx20System@UnicodeStringt1

vcl260.bpl

@Vcl@Forms@TScrollBox@$bcctr$qqrv
@Vcl@Stdctrls@TCustomStaticText@$bcctr$qqrv
@Vcl@Forms@TScrollBox@$bcdtr$qqrv
@Vcl@Stdctrls@TCustomStaticText@$bcdtr$qqrv
@Vcl@Graphics@TWICImage@$bcctr$qqrv
@Vcl@Stdctrls@TCustomEdit@$bcctr$qqrv
@Vcl@Stdctrls@TStaticText@$bcctr$qqrv
@Vcl@Graphics@TWICImage@$bcdtr$qqrv
@Vcl@Stdctrls@TCustomEdit@$bcdtr$qqrv
@Vcl@Stdctrls@TCheckBox@$bcctr$qqrv
@Vcl@Stdctrls@TCustomGroupBox@$bcctr$qqrv
@Vcl@Stdctrls@TStaticText@$bcdtr$qqrv
@Vcl@Stdctrls@TCustomGroupBox@$bcdtr$qqrv
@Vcl@Stdctrls@TCheckBox@$bcdtr$qqrv
@Vcl@Comctrls@TCustomComboBoxEx@$bcctr$qqrv
@Vcl@Comctrls@TCustomComboBoxEx@$bcdtr$qqrv
@Vcl@Comctrls@TUpDown@$bcctr$qqrv
@Vcl@Comctrls@TUpDown@$bcdtr$qqrv
@Vcl@Comctrls@TStatusBar@$bcctr$qqrv
@Vcl@Clipbrd@Finalization$qqrv
@Vcl@Comctrls@TDateTimePicker@$bcctr$qqrv
@Vcl@Comctrls@TDateTimePicker@$bcdtr$qqrv
@Vcl@Comctrls@TStatusBar@$bcdtr$qqrv
@Vcl@Comctrls@TProgressBar@$bcctr$qqrv
@Vcl@Stdctrls@TCustomButton@$bcctr$qqrv
@Vcl@Stdctrls@TListBox@$bcctr$qqrv
@Vcl@Comctrls@TProgressBar@$bcdtr$qqrv
@Vcl@Stdctrls@TListBox@$bcdtr$qqrv
@Vcl@Comctrls@TCustomStatusBar@$bcctr$qqrv
@Vcl@Stdctrls@TEdit@$bcctr$qqrv
@Vcl@Stdctrls@TCustomButton@$bcdtr$qqrv
@Vcl@Comctrls@TCustomStatusBar@$bcdtr$qqrv
@Vcl@Printers@initialization$qqrv
@Vcl@Controls@initialization$qqrv
@Vcl@Actnlist@initialization$qqrv
@Vcl@Graphics@Finalization$qqrv
@Vcl@Stdctrls@TEdit@$bcdtr$qqrv
@Vcl@Comctrls@TCustomHotKey@$bcctr$qqrv
@Vcl@Comctrls@TCustomHotKey@$bcdtr$qqrv
@Vcl@Stdctrls@TGroupBox@$bcctr$qqrv
@Vcl@Stdctrls@TMemo@$bcctr$qqrv
@Vcl@Stdctrls@TGroupBox@$bcdtr$qqrv
@Vcl@Comctrls@TTreeView@$bcctr$qqrv
@Vcl@Stdctrls@TMemo@$bcdtr$qqrv
@Vcl@Comctrls@TTreeView@$bcdtr$qqrv
@Vcl@Comctrls@TTrackBar@$bcctr$qqrv
@Vcl@Comctrls@TTrackBar@$bcdtr$qqrv
@Vcl@Menus@initialization$qqrv
@Vcl@Menus@Finalization$qqrv
@Vcl@Actnlist@Finalization$qqrv
@Vcl@Dialogs@Finalization$qqrv
@Vcl@Stdctrls@TCustomCheckBox@$bcctr$qqrv
@Vcl@Stdctrls@TCustomCheckBox@$bcdtr$qqrv
@Vcl@Stdctrls@TScrollBar@$bcctr$qqrv
@Vcl@Comctrls@TCustomTreeView@$bcctr$qqrv
@Vcl@Comctrls@TCustomTreeView@$bcdtr$qqrv
@Vcl@Stdctrls@TScrollBar@$bcdtr$qqrv
@Vcl@Themes@TStyleManager@$bcctr$qqrv
@Vcl@Comctrls@THeaderControl@$bcdtr$qqrv
@Vcl@Comctrls@THeaderControl@$bcctr$qqrv
@Vcl@Themes@TStyleManager@$bcdtr$qqrv
@Vcl@Comctrls@TCustomTabControl@$bcctr$qqrv
@Vcl@Comctrls@TCustomUpDown@$bcctr$qqrv
@Vcl@Comctrls@TCustomTabControl@$bcdtr$qqrv
@Vcl@Graphutil@initialization$qqrv
@Vcl@Comctrls@TCustomUpDown@$bcdtr$qqrv
@Vcl@Themes@TCustomStyleEngine@$bcctr$qqrv
@Vcl@Themes@TCustomStyleEngine@$bcdtr$qqrv
@Vcl@Comctrls@THotKey@$bcctr$qqrv
@Vcl@Comctrls@THotKey@$bcdtr$qqrv
@Vcl@Extctrls@initialization$qqrv
@Vcl@Comctrls@TCoolBar@$bcctr$qqrv
@Vcl@Comctrls@TCoolBar@$bcdtr$qqrv
@Vcl@Comctrls@TCustomListView@$bcctr$qqrv
@Vcl@Comctrls@TCustomListView@$bcdtr$qqrv
@Vcl@Graphutil@Finalization$qqrv
@Vcl@Comctrls@TCustomRichEdit@$bcctr$qqrv
@Vcl@Comctrls@TCustomRichEdit@$bcdtr$qqrv
@Vcl@Forms@Finalization$qqrv
@Vcl@Comctrls@initialization$qqrv
@Vcl@Stdctrls@TComboBox@$bcctr$qqrv
@Vcl@Graphics@initialization$qqrv
@Vcl@Stdctrls@TComboBox@$bcdtr$qqrv
@Vcl@Stdctrls@TCustomListBox@$bcctr$qqrv
@Vcl@Stdctrls@TCustomListBox@$bcdtr$qqrv
@Vcl@Comctrls@TPageScroller@$bcctr$qqrv
@Vcl@Forms@initialization$qqrv
@Vcl@Comctrls@TPageScroller@$bcdtr$qqrv
@Vcl@Forms@TCustomForm@$bcctr$qqrv
@Vcl@Forms@TCustomForm@$bcdtr$qqrv
@Vcl@Comctrls@TListView@$bcctr$qqrv
@Vcl@Comctrls@TListView@$bcdtr$qqrv
@Vcl@Comctrls@TComboBoxEx@$bcctr$qqrv
@Vcl@Stdctrls@TCustomMemo@$bcctr$qqrv
@Vcl@Extctrls@TLinkLabel@$bcctr$qqrv
@Vcl@Comctrls@TComboBoxEx@$bcdtr$qqrv
@Vcl@Stdctrls@TCustomMemo@$bcdtr$qqrv
@Vcl@Extctrls@TLinkLabel@$bcdtr$qqrv
@Vcl@Stdctrls@TRadioButton@$bcctr$qqrv
@Vcl@Stdctrls@TButton@$bcctr$qqrv
@Vcl@Stdctrls@TButton@$bcdtr$qqrv
@Vcl@Stdctrls@TRadioButton@$bcdtr$qqrv
@Vcl@Extctrls@TCustomLinkLabel@$bcctr$qqrv
@Vcl@Extctrls@TCustomLinkLabel@$bcdtr$qqrv
@Vcl@Comctrls@TCustomHeaderControl@$bcctr$qqrv
@Vcl@Comctrls@TCustomHeaderControl@$bcdtr$qqrv
@Vcl@Dialogs@initialization$qqrv
@Vcl@Extctrls@TCategoryPanelGroup@$bcctr$qqrv
@Vcl@Extctrls@TCategoryPanelGroup@$bcdtr$qqrv
@Vcl@Printers@Finalization$qqrv
@Vcl@Controls@Finalization$qqrv
@Vcl@Clipbrd@initialization$qqrv
@Vcl@Comctrls@TTabControl@$bcctr$qqrv
@Vcl@Comctrls@Finalization$qqrv
@Vcl@Comctrls@TTabControl@$bcdtr$qqrv
@Vcl@Extctrls@Finalization$qqrv
@Vcl@Comctrls@TRichEdit@$bcctr$qqrv
@Vcl@Stdctrls@TCustomComboBox@$bcctr$qqrv
@Vcl@Stdctrls@TCustomComboBox@$bcdtr$qqrv
@Vcl@Comctrls@TRichEdit@$bcdtr$qqrv
@Vcl@Forms@TForm@$bcctr$qqrv
@Vcl@Forms@TForm@$bcdtr$qqrv
@Vcl@Extctrls@TCustomCategoryPanelGroup@$bcctr$qqrv
@Vcl@Comctrls@TToolBar@$bcctr$qqrv
@Vcl@Extctrls@TCustomCategoryPanelGroup@$bcdtr$qqrv
@Vcl@Comctrls@TToolBar@$bcdtr$qqrv

firedaccommon260.bpl

@Firedac@Stan@Factory@Finalization$qqrv
@Firedac@Stan@Sqltimeint@initialization$qqrv
@Firedac@Stan@Util@Finalization$qqrv
@Firedac@Stan@Util@initialization$qqrv
@Firedac@Stan@Error@initialization$qqrv
@Firedac@Ui@Intf@Finalization$qqrv
@Firedac@Stan@Factory@initialization$qqrv
@Firedac@Dats@initialization$qqrv
@Firedac@Dats@Finalization$qqrv
@Firedac@Stan@Expr@Finalization$qqrv
@Firedac@Stan@Error@Finalization$qqrv
@Firedac@Ui@Intf@initialization$qqrv
@Firedac@Stan@Option@initialization$qqrv
@Firedac@Stan@Option@Finalization$qqrv
@Firedac@Stan@Sqltimeint@Finalization$qqrv
@Firedac@Stan@Expr@initialization$qqrv
@Firedac@Stan@Param@Finalization$qqrv
@Firedac@Stan@Intf@initialization$qqrv
@Firedac@Stan@Param@initialization$qqrv
@Firedac@Stan@Intf@Finalization$qqrv

Exports

Exports

@$xp$20Bshdata@TBplusShData
@$xp$24Bshfmtstr@TBplusShFmtStr
@Bplussharedata@@GetPackageInfoTable$qqrv
@Bplussharedata@@PackageLoad$qqrv
@Bplussharedata@@PackageUnload$qqrv
@Bplussharedata@initialization$qqrv
@Bshconst@Finalization$qqrv
@Bshconst@_rstrAscending
@Bshconst@_rstrBackupComment
@Bshconst@_rstrCancelCommand
@Bshconst@_rstrCash
@Bshconst@_rstrCommonCondition
@Bshconst@_rstrComplete
@Bshconst@_rstrConfirmCancel
@Bshconst@_rstrConfirmDelete
@Bshconst@_rstrCreateDBMS
@Bshconst@_rstrDelete
@Bshconst@_rstrDeleteRpfInfo
@Bshconst@_rstrDeleteRpgInfo
@Bshconst@_rstrDeptCode
@Bshconst@_rstrDeptEngDesc
@Bshconst@_rstrDeptThDesc
@Bshconst@_rstrDescending
@Bshconst@_rstrDownToBaht
@Bshconst@_rstrDownto1000Baht
@Bshconst@_rstrDownto100Baht
@Bshconst@_rstrDownto10Baht
@Bshconst@_rstrDownto250Baht
@Bshconst@_rstrDownto25Stang
@Bshconst@_rstrDownto500Baht
@Bshconst@_rstrDownto50Baht
@Bshconst@_rstrDownto50Stang
@Bshconst@_rstrDownto5Baht
@Bshconst@_rstrDuplicate
@Bshconst@_rstrECantCreateLog
@Bshconst@_rstrECantDelete
@Bshconst@_rstrECantDeleteWText
@Bshconst@_rstrECantEdit
@Bshconst@_rstrECantEditRegisterNo
@Bshconst@_rstrECantInsert
@Bshconst@_rstrECompactVersion
@Bshconst@_rstrEDateRange
@Bshconst@_rstrEEnter0to100
@Bshconst@_rstrEEnter1to100
@Bshconst@_rstrEEnterValue0to12
@Bshconst@_rstrEEnterValue0to31
@Bshconst@_rstrEEnterValue1to12
@Bshconst@_rstrEEnterValueMustGreater0
@Bshconst@_rstrEEnterValueMustGreaterEqual0
@Bshconst@_rstrEEnterValueMustLessEqual0
@Bshconst@_rstrEFileNotFound
@Bshconst@_rstrEFoundButFilter
@Bshconst@_rstrEGrantDelete01
@Bshconst@_rstrEGrantDelete02
@Bshconst@_rstrEGrantDuplicate01
@Bshconst@_rstrEGrantDuplicate02
@Bshconst@_rstrEGrantExecute01
@Bshconst@_rstrEGrantExecute02
@Bshconst@_rstrEGrantInsert01
@Bshconst@_rstrEGrantInsert02
@Bshconst@_rstrEGrantUpdate01
@Bshconst@_rstrEGrantUpdate02
@Bshconst@_rstrEHasRefer
@Bshconst@_rstrEInvalidDate
@Bshconst@_rstrEInvalidTime
@Bshconst@_rstrEInvalidYear
@Bshconst@_rstrENoRptFile
@Bshconst@_rstrEPostError
@Bshconst@_rstrEReApply01
@Bshconst@_rstrEReApply02
@Bshconst@_rstrERefresh
@Bshconst@_rstrERptFileNotExist
@Bshconst@_rstrEWasDelete
@Bshconst@_rstrEYearMonth
@Bshconst@_rstrEYearOutOfRange
@Bshconst@_rstrEdit
@Bshconst@_rstrFileNotFoundInfo
@Bshconst@_rstrFind
@Bshconst@_rstrFiveDigit
@Bshconst@_rstrFourDigit
@Bshconst@_rstrInfoInHelp
@Bshconst@_rstrInsert
@Bshconst@_rstrLanscape
@Bshconst@_rstrNear1000Baht
@Bshconst@_rstrNear100Baht
@Bshconst@_rstrNear10Baht
@Bshconst@_rstrNear250Baht
@Bshconst@_rstrNear25Stang
@Bshconst@_rstrNear500Baht
@Bshconst@_rstrNear50Baht
@Bshconst@_rstrNear50Stang
@Bshconst@_rstrNear5Baht
@Bshconst@_rstrNearBaht
@Bshconst@_rstrNeedRefresh01
@Bshconst@_rstrNeedRefresh02
@Bshconst@_rstrNeedRefresh03
@Bshconst@_rstrNextRef
@Bshconst@_rstrNoOfRecord
@Bshconst@_rstrNoRef
@Bshconst@_rstrNoRound
@Bshconst@_rstrOneDigit
@Bshconst@_rstrPleaseRegister
@Bshconst@_rstrPortriat
@Bshconst@_rstrRegisterReport
@Bshconst@_rstrReportNotFound
@Bshconst@_rstrRpfNotfound
@Bshconst@_rstrSameAsPrinterSetting
@Bshconst@_rstrSameAsVc
@Bshconst@_rstrSampleBplusForWindows
@Bshconst@_rstrSaveFindResult
@Bshconst@_rstrSelectRptFile
@Bshconst@_rstrSixDigit
@Bshconst@_rstrThreeDigit
@Bshconst@_rstrTwoDigit
@Bshconst@_rstrUpto1000Baht
@Bshconst@_rstrUpto100Baht
@Bshconst@_rstrUpto10Baht
@Bshconst@_rstrUpto250Baht
@Bshconst@_rstrUpto25Stang
@Bshconst@_rstrUpto500Baht
@Bshconst@_rstrUpto50Baht
@Bshconst@_rstrUpto50Stang
@Bshconst@_rstrUpto5Baht
@Bshconst@_rstrUptoBaht
@Bshconst@_rstrVatRef
@Bshconst@initialization$qqrv
@Bshdata@BplusAliasName
@Bshdata@BplusAppDataPath
@Bshdata@BplusAutoBackupDir
@Bshdata@BplusBaseLanguage
@Bshdata@BplusComputerName
@Bshdata@BplusConnectionDriverID
@Bshdata@BplusConnectionName
@Bshdata@BplusCrPrintPath
@Bshdata@BplusCrystalConfFileName
@Bshdata@BplusCurrentGuid
@Bshdata@BplusCurrentkey
@Bshdata@BplusDataBaseGuid
@Bshdata@BplusDataBaseIni
@Bshdata@BplusDbFileName
@Bshdata@BplusDefaultHelpPath
@Bshdata@BplusDocumentDir
@Bshdata@BplusEmpDir
@Bshdata@BplusEmptyFireBirdFileName
@Bshdata@BplusExePath
@Bshdata@BplusFdcConnectFileName
@Bshdata@BplusFileVersionData
@Bshdata@BplusLogConnectionName
@Bshdata@BplusLogDatabaseName
@Bshdata@BplusLogTableName
@Bshdata@BplusLoginName
@Bshdata@BplusLoginPassword
@Bshdata@BplusMinDate
@Bshdata@BplusPackDir
@Bshdata@BplusPosDataBDir
@Bshdata@BplusPosDataHDir
@Bshdata@BplusProductName
@Bshdata@BplusQrUrl
@Bshdata@BplusRefresh
@Bshdata@BplusReportDir
@Bshdata@BplusShData
@Bshdata@BplusStructurePath
@Bshdata@BplusUpgradeIni
@Bshdata@BplusUserKey
@Bshdata@BplusUserLevel
@Bshdata@BplusUserMobile
@Bshdata@BplusUserName
@Bshdata@BplusUserPassword
@Bshdata@BplusUserPosn
@Bshdata@BplusWindowsUserName
@Bshdata@BplusWsUrl
@Bshdata@BplusYearBase
@Bshdata@CompanyBranchNo
@Bshdata@CompanyCntryCode
@Bshdata@CompanyCurrencyCode
@Bshdata@CompanyEmCrncyName
@Bshdata@CompanyEsCrncyName
@Bshdata@CompanyFax
@Bshdata@CompanyIsoCode
@Bshdata@CompanyPost
@Bshdata@CompanyPrefix
@Bshdata@CompanyRegNo
@Bshdata@CompanySwNo
@Bshdata@CompanyTaxID
@Bshdata@CompanyTaxType
@Bshdata@CompanyTelNo
@Bshdata@CompanyTmCrncyName
@Bshdata@CompanyTsCrncyName
@Bshdata@EngAddress_1
@Bshdata@EngAddress_2
@Bshdata@EngAddress_3
@Bshdata@EngBranchName
@Bshdata@EngCompanyName
@Bshdata@EngCountry
@Bshdata@EngDistrict
@Bshdata@EngProvince
@Bshdata@EngSubDistrict
@Bshdata@Finalization$qqrv
@Bshdata@ShareFolderFtpPassive
@Bshdata@ShareFolderFtpPassword
@Bshdata@ShareFolderFtpPort
@Bshdata@ShareFolderFtpServer
@Bshdata@ShareFolderFtpUserName
@Bshdata@ShareFolderLcPath
@Bshdata@ShareFolderNwPassword
@Bshdata@ShareFolderNwPath
@Bshdata@ShareFolderNwUserName
@Bshdata@ShareFolderSelect
@Bshdata@ShareFolderUrl
@Bshdata@ShareFolderUrlPath
@Bshdata@TBplusShData@
@Bshdata@TBplusShData@ClearCompanyInfo$qqrv
@Bshdata@TBplusShData@ClearDbmsConnectInfo$qqrv
@Bshdata@TBplusShData@GetAllShData$qqrp26System@Classes@TStringList
@Bshdata@TBplusShData@GetCompanyInfo$qqrp33Firedac@Comp@Client@TFDConnection
@Bshdata@TBplusShData@GetDbmsConnectInfo$qqrx20System@UnicodeStringt1t1t1
@Bshdata@TBplusShData@GetEnvironmentData$qqrx20System@UnicodeString
@Bshdata@TBplusShData@GetFileInfoData$qqrv
@Bshdata@TBplusShData@GetValue$qqrp28Firedac@Comp@Client@TFDQuery20System@UnicodeStringt2
@Bshdata@TBplusShData@SetCurrentUser$qqrxi
@Bshdata@TBplusShData@SetLoginUserData$qqrxix20System@UnicodeStringxixi
@Bshdata@ThaiAddress_1
@Bshdata@ThaiAddress_2
@Bshdata@ThaiAddress_3
@Bshdata@ThaiBranchName
@Bshdata@ThaiCompanyName
@Bshdata@ThaiCountry
@Bshdata@ThaiDistrict
@Bshdata@ThaiLicCompanyName
@Bshdata@ThaiProvince
@Bshdata@ThaiSubDistrict
@Bshdata@initialization$qqrv
@Bshdata@msgBplusRefresh
@Bshfmtstr@BahtDigit
@Bshfmtstr@BplusShFmtStr
@Bshfmtstr@Finalization$qqrv
@Bshfmtstr@PercentDigit
@Bshfmtstr@QtyDigit
@Bshfmtstr@TBplusShFmtStr@
@Bshfmtstr@TBplusShFmtStr@SetDecimalDigit$qqrx20System@UnicodeStringus
@Bshfmtstr@TBplusShFmtStr@SetDefaultDigit$qqrv
@Bshfmtstr@TBplusShFmtStr@SetDefaultEditMaskAndFormatStr$qqrv
@Bshfmtstr@TBplusShFmtStr@SetZeroDigit$qqrxus
@Bshfmtstr@UPrcDigit
@Bshfmtstr@WeightDigit
@Bshfmtstr@ZeroBahtEditMask
@Bshfmtstr@ZeroPercentEditMask
@Bshfmtstr@ZeroQtyEditMask
@Bshfmtstr@ZeroUPrcEditMask
@Bshfmtstr@ZeroWeightEditMask
@Bshfmtstr@ZeroXRateEditMask
@Bshfmtstr@dsplBahtEditMask
@Bshfmtstr@dsplBahtFmtStr
@Bshfmtstr@dsplMinusBahtFmtStr
@Bshfmtstr@dsplPercentEditMask
@Bshfmtstr@dsplPercentFmtStr
@Bshfmtstr@dsplQtyEditMask
@Bshfmtstr@dsplQtyFmtStr
@Bshfmtstr@dsplUPrcEditMask
@Bshfmtstr@dsplUPrcFmtStr
@Bshfmtstr@dsplWeightEditMask
@Bshfmtstr@dsplWeightFmtStr
@Bshfmtstr@dsplXRateEditMask
@Bshfmtstr@dsplXrateFmtStr
@Bshfmtstr@editBahtEditMask
@Bshfmtstr@editPercentEditMask
@Bshfmtstr@editQtyEditMask
@Bshfmtstr@editUPrcEditMask
@Bshfmtstr@editWeightEditMask
@Bshfmtstr@editXRateEditMask
@Bshfmtstr@initialization$qqrv
@GetPackageInfoTable
Finalize
Initialize
__dbk_fcall_wrapper
dbkFCallWrapperAddr

Sections

.text
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 616B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 69B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ec19f0f00fe3527e8da88373f08d8d4f

Headers

File Characteristics

Imports

kernel32

rtl260.bpl

bplussharemsc.bpl

dbrtl260.bpl

user32

firedac260.bpl

bplusfiredacsys.bpl

vcl260.bpl

firedaccommon260.bpl

Exports

Exports

Sections

.text Size: 29KB - Virtual size: 28KB

.itext Size: 1KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 192B

.bss Size: - Virtual size: 616B

.idata Size: 16KB - Virtual size: 16KB

.edata Size: 10KB - Virtual size: 10KB

.rdata Size: 512B - Virtual size: 69B

.reloc Size: 3KB - Virtual size: 3KB

.rsrc Size: 7KB - Virtual size: 7KB

.text
Size: 29KB - Virtual size: 28KB

.itext
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 192B

.bss
Size: - Virtual size: 616B

.idata
Size: 16KB - Virtual size: 16KB

.edata
Size: 10KB - Virtual size: 10KB

.rdata
Size: 512B - Virtual size: 69B

.reloc
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 7KB - Virtual size: 7KB