48ce5263a07c298c3fbef8e4e96fc8b0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

48ce5263a07c298c3fbef8e4e96fc8b0N.exe
Size

336KB
MD5

48ce5263a07c298c3fbef8e4e96fc8b0
SHA1

15eda6a31a821b160c2585ea7f58e0f0f5ed060f
SHA256

2ec1e931e8c414c3427e810293ae2502a9eb69ac89186a1bcb1987d1e54f8c29
SHA512

c2df49be2c8249f962ead46ba4d12edeaba1b9573e2645a17910f9fe169d6eead6a18741f11cc4eea7844222d7d4d37d00adcb89ce0f0af9e8cf4eaee9eda0b6
SSDEEP

6144:dKokp5reT3nNuVnPtIAyZe4tX2mwzEFEPRUKMBL2aTRv:Mokp5reT3nonPyAQe4tX2p4FtK0aCv

Score

1^/10

Malware Config

Signatures

Files

48ce5263a07c298c3fbef8e4e96fc8b0N.exe
.dll windows:5 windows x86 arch:x86

fa5ffeafc713c08acec41a7699705f80

Code Sign

4f:63:d0:30:f8:15:a3:a5:b3:44:69:40:06:3d:16:89
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

17/05/2005, 00:00

Not After

16/05/2010, 23:59

Subject

CN=Comodo Time Stamping Signer,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

91:d9:a0:84:0b:6c:b0:65:f7:40:9e:d4:29:f9:76:e2
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

02/04/2008, 00:00

Not After

02/04/2011, 23:59

Subject

CN=Auslogics Software,O=Auslogics Software,POSTALCODE=2000,STREET=1st Floor\, 193 Clarence Street,L=Sydney,ST=NSW,C=AU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3b:53:7f:64:24:e5:83:05:21:b1:3e:3c:41:07:70:03:65:63:10:cd
Signer

Actual PE Digest

3b:53:7f:64:24:e5:83:05:21:b1:3e:3c:41:07:70:03:65:63:10:cd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

rtl120.bpl

@System@initialization$qqrv
@System@Finalization$qqrv
@System@LoadResString$qqrp20System@TResStringRec
@System@UTF8Encode$qqrx31System@%AnsiStringT$us$i65535$%
@System@FreeMemory$qpv
@System@TInterfacedObject@_Release$qqsv
@System@TInterfacedObject@_AddRef$qqsv
@System@TInterfacedObject@QueryInterface$qqsrx5_GUIDpv
@System@TInterfacedObject@NewInstance$qqrv
@System@TInterfacedObject@BeforeDestruction$qqrv
@System@TInterfacedObject@AfterConstruction$qqrv
@System@@IntfAddRef$qqrx45System@%DelphiInterface$t17System@IInterface%
@System@@IntfCast$qqrr45System@%DelphiInterface$t17System@IInterface%x45System@%DelphiInterface$t17System@IInterface%rx5_GUID
@System@@IntfCopy$qqrr45System@%DelphiInterface$t17System@IInterface%x45System@%DelphiInterface$t17System@IInterface%
@System@@IntfClear$qqrr45System@%DelphiInterface$t17System@IInterface%
@System@UnregisterModule$qqrp17System@TLibModule
@System@RegisterModule$qqrp17System@TLibModule
@System@FindResourceHInstance$qqrui
@System@@DynArrayAddRef$qqrv
@System@@DynArrayAsg$qqrv
@System@@DynArrayClear$qqrrpvpv
@System@@DynArrayCopy$qqrpvt1rpv
@System@@DynArraySetLength$qqrv
@System@@DynArrayHigh$qqrv
@System@@DynArrayLength$qqrv
@System@@_llshl$qqrv
@System@@_llmod$qqrv
@System@@_lldiv$qqrv
@System@@_llmul$qqrv
@System@@CopyRecord$qqrv
@System@@Finalize$qqrpvt1
@System@@FinalizeArray$qqrpvt1ui
@System@@FinalizeRecord$qqrpvt1
@System@@InitializeRecord$qqrpvt1
@System@@UniqueStringU$qqrr20System@UnicodeString
@System@@UStrDelete$qqrr20System@UnicodeStringii
@System@@UStrCopy$qqrx20System@UnicodeStringii
@System@@UStrEqual$qqrv
@System@@UStrCatN$qqrv
@System@@UStrCat3$qqrr20System@UnicodeStringx20System@UnicodeStringt2
@System@@UStrCat$qqrr20System@UnicodeStringx20System@UnicodeString
@System@@UStrSetLength$qqrr20System@UnicodeStringi
@System@@UStrLen$qqrx20System@UnicodeString
@System@@UStrFromString$qqrr20System@UnicodeStringrx28System@%SmallString$iuc$255%
@System@@UStrFromWStr$qqrr20System@UnicodeStringx17System@WideString
@System@@LStrFromUStr$qqrr27System@%AnsiStringT$us$i0$%x20System@UnicodeStringus
@System@@UStrFromLStr$qqrr20System@UnicodeStringx27System@%AnsiStringT$us$i0$%
@System@@UStrFromWArray$qqrr20System@UnicodeStringpbi
@System@@UStrFromArray$qqrr20System@UnicodeStringpci
@System@@UStrFromPWChar$qqrr20System@UnicodeStringpb
@System@@UStrFromPChar$qqrr20System@UnicodeStringpc
@System@@UStrToPWChar$qqrx20System@UnicodeString
@System@@UStrAsg$qqrr20System@UnicodeStringx20System@UnicodeString
@System@@UStrArrayClr$qqrpvi
@System@@UStrClr$qqrpv
@System@@UStrAddRef$qqrpv
@System@@WStrClr$qqrpv
@System@@Write0LString$qqrr15System@TTextRecx27System@%AnsiStringT$us$i0$%
@System@@LStrSetLength$qqrv
@System@Pos$qqrx31System@%AnsiStringT$us$i65535$%t1
@System@@LStrInsert$qqrv
@System@@LStrDelete$qqrv
@System@@LStrCopy$qqrv
@System@@UniqueStringA$qqrr27System@%AnsiStringT$us$i0$%
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%
@System@@LStrAddRef$qqrpv
@System@@LStrEqual$qqrv
@System@@LStrCatN$qqrv
@System@@LStrCat3$qqrv
@System@@LStrCat$qqrv
@System@@PCharLen$qqrpc
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%
@System@@LStrFromArray$qqrr27System@%AnsiStringT$us$i0$%pcius
@System@@LStrFromString$qqrr27System@%AnsiStringT$us$i0$%rx28System@%SmallString$iuc$255%us
@System@@LStrFromPWChar$qqrr27System@%AnsiStringT$us$i0$%pbus
@System@@LStrFromPChar$qqrr27System@%AnsiStringT$us$i0$%pcus
@System@@LStrFromChar$qqrr27System@%AnsiStringT$us$i0$%cus
@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us
@System@@EnsureUnicodeString$qqrr20System@UnicodeString
@System@@LStrFromPCharLen$qqrr27System@%AnsiStringT$us$i0$%pcius
@System@@LStrLAsg$qqrpvpxv
@System@@LStrAsg$qqrpvpxv
@System@@LStrArrayClr$qqrpvi
@System@@LStrClr$qqrpv
@System@BeginThread$qqrpvuipqqrpv$it1uirui
@System@@RunError$qqruc
@System@@Halt0$qqrv
@System@@PackageUnload$qqrpx23System@PackageInfoTablep17System@TLibModule
@System@@PackageLoad$qqrpx23System@PackageInfoTablep17System@TLibModule
@System@@TryFinallyExit$qqrv
@System@@DoneExcept$qqrv
@System@@RaiseAgain$qqrv
@System@@RaiseExcept$qqrv
@System@@HandleAutoException$qqrv
@System@@HandleFinally$qqrv
@System@@HandleOnException$qqrv
@System@@HandleAnyException$qqrv
@System@@BeforeDestruction$qqrp14System@TObjectzc
@System@@AfterConstruction$qqrp14System@TObject
@System@@ClassDestroy$qqrp14System@TObject
@System@@ClassCreate$qqrp17System@TMetaClasso
@System@TObject@Dispatch$qqrpv
@System@TObject@BeforeDestruction$qqrv
@System@TObject@AfterConstruction$qqrv
@System@TObject@DefaultHandler$qqrpv
@System@TObject@ToString$qqrv
@System@TObject@SafeCallException$qqrp14System@TObjectpv
@System@TObject@ClassInfo$qqrv
@System@@IsClass$qqrp14System@TObjectp17System@TMetaClass
@System@TObject@GetHashCode$qqrv
@System@TObject@Equals$qqrp14System@TObject
@System@TObject@Free$qqrv
@System@TObject@$bdtr$qqrv
@System@TObject@$bctr$qqrv
@System@TObject@FreeInstance$qqrv
@System@TObject@NewInstance$qqrv
@System@TObject@ClassParent$qqrv
@System@TObject@ClassName$qqrv
@System@TObject@ClassType$qqrv
@System@@WriteLn$qqrr15System@TTextRec
@System@@FillChar$qqrpvib
@System@@AStrCmp$qqrv
@System@@ROUND$qqrv
@System@Get8087CW$qqrv
@System@Set8087CW$qqrus
@System@ParamCount$qqrv
@System@Move$qqrpxvpvi
@System@@_IOTest$qqrv
@System@RaiseList$qqrv
@System@AcquireExceptionObject$qqrv
@System@ExceptObject$qqrv
@System@@FreeMem$qqrpv
@System@@GetMem$qqri
@System@DebugHook
@System@HeapAllocFlags
@System@Output
@System@IsMultiThread
@System@IsConsole
@System@ErrorAddr
@System@MainThreadID
@System@ExceptObjProc
@System@TInterfacedObject@
@$xp$17System@IInterface
@$xp$14System@TObject
@System@TObject@
@$xp$17System@AnsiString
@$xp$13System@string
@$xp$8Cardinal
@$xp$7Boolean
@Sysconst@_SModuleAccessViolation
@Sysconst@_SExternalException
@Sysconst@_SWriteAccess
@Sysconst@_SReadAccess
@Sysconst@_SPrivilege
@Sysconst@_SControlC
@Sysconst@_SStackOverflow
@Sysconst@_SUnderflow
@Sysconst@_SOverflow
@Sysconst@_SZeroDivide
@Sysconst@_SInvalidOp
@Sysconst@_SIntOverflow
@Sysconst@_SRangeError
@Sysconst@_SDivByZero
@Typinfo@initialization$qqrv
@Typinfo@Finalization$qqrv
@Typinfo@GetInt64Prop$qqrp14System@TObjectp17Typinfo@TPropInfo
@Typinfo@GetVariantProp$qqrp14System@TObjectp17Typinfo@TPropInfo
@Typinfo@GetFloatProp$qqrp14System@TObjectp17Typinfo@TPropInfo
@Typinfo@GetWideStrProp$qqrp14System@TObjectp17Typinfo@TPropInfo
@Typinfo@GetStrProp$qqrp14System@TObjectp17Typinfo@TPropInfo
@Typinfo@GetOrdProp$qqrp14System@TObjectp17Typinfo@TPropInfo
@Typinfo@GetPropList$qqrp17Typinfo@TTypeInfo46System@%Set$t17Typinfo@TTypeKind$iuc$0$iuc$18%p50System@%StaticArray$p17Typinfo@TPropInfoi$i16380$%o
@Typinfo@GetEnumName$qqrp17Typinfo@TTypeInfoi
@Typinfo@GetTypeData$qqrp17Typinfo@TTypeInfo
@Sysutils@initialization$qqrv
@Sysutils@Finalization$qqrv
@Sysutils@FloatToStr$qqrg
@Sysutils@IntToStr$qqrj
@Sysutils@IntToStr$qqri
@Variants@initialization$qqrv
@Variants@Finalization$qqrv
@Variants@@VarAdd$qqrr8TVarDatarx8TVarData
@Variants@@VarFromUStr$qqrr8TVarDatax20System@UnicodeString
@Variants@@VarToUStr$qqrr20System@UnicodeStringrx8TVarData
@Variants@@VarClr$qqrr8TVarData
@Varutils@initialization$qqrv
@Varutils@Finalization$qqrv

kernel32

TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
FreeLibrary
WriteFile
WaitForSingleObject
VirtualQuery
VirtualProtect
VirtualFree
VirtualAlloc
UnmapViewOfFile
TerminateThread
TerminateProcess
SystemTimeToFileTime
SuspendThread
Sleep
SizeofResource
SetUnhandledExceptionFilter
SetThreadPriority
SetLastError
SetFilePointer
SetFileAttributesA
SetEvent
SetEndOfFile
ResumeThread
ResetEvent
RemoveDirectoryA
ReleaseMutex
ReadProcessMemory
ReadFile
RaiseException
QueryPerformanceFrequency
QueryPerformanceCounter
OpenProcess
OpenFileMappingA
OpenFileMappingW
MapViewOfFile
LockResource
LocalSize
LocalFree
LocalAlloc
LoadResource
LoadLibraryW
LeaveCriticalSection
IsBadReadPtr
InitializeCriticalSection
GlobalUnlock
GlobalReAlloc
GlobalMemoryStatus
GlobalHandle
GlobalLock
GlobalFree
GlobalAlloc
GetWindowsDirectoryA
GetVersion
GetTickCount
GetThreadPriority
GetThreadContext
GetTempPathA
GetSystemTime
GetSystemDirectoryW
GetProcAddress
GetPriorityClass
GetModuleHandleA
GetModuleHandleW
GetModuleFileNameA
GetModuleFileNameW
GetLocaleInfoA
GetLocalTime
GetLastError
GetFileSize
GetFileAttributesA
GetDiskFreeSpaceA
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetComputerNameA
GetCommandLineA
GetCommandLineW
FreeResource
InterlockedIncrement
InterlockedDecrement
FreeLibrary
FindResourceA
FindResourceW
FindNextFileA
FindFirstFileA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FileTimeToDosDateTime
ExpandEnvironmentStringsA
ExitThread
ExitProcess
EnterCriticalSection
DuplicateHandle
DeleteFileA
DeleteCriticalSection
CreateThread
CreateRemoteThread
CreateProcessA
CreateProcessW
CreatePipe
CreateMutexA
CreateMutexW
CreateFileMappingA
CreateFileMappingW
CreateFileA
CreateEventW
CreateDirectoryA
CopyFileA
CloseHandle
Beep
RtlUnwind

user32

CreateWindowExA
CreateWindowExW
WindowFromPoint
TranslateMessage
SystemParametersInfoW
ShowWindow
SetWindowTextA
SetWindowPos
SetWindowLongA
SetTimer
SetRect
SetForegroundWindow
SetFocus
SetCursor
SetClipboardData
SetCapture
SetActiveWindow
SendMessageTimeoutA
SendMessageA
SendMessageW
ScreenToClient
RemoveMenu
ReleaseDC
ReleaseCapture
RegisterWindowMessageW
RegisterClassA
PostThreadMessageA
PostThreadMessageW
PostQuitMessage
PostMessageA
PostMessageW
PeekMessageA
PeekMessageW
OpenClipboard
OffsetRect
MessageBoxA
MessageBeep
LoadImageA
LoadCursorW
KillTimer
IsWindowVisible
IsWindowUnicode
IsWindowEnabled
IsWindow
IsIconic
IsDialogMessageW
InvalidateRect
InflateRect
GetWindowThreadProcessId
GetWindowTextA
GetWindowRect
GetWindowPlacement
GetWindowLongW
GetWindowDC
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSysColor
GetWindow
GetMessageA
GetMessageW
GetKeyState
GetIconInfo
GetFocus
GetDC
GetCursorPos
GetCursor
GetClientRect
GetClassNameA
GetCapture
FrameRect
FindWindowW
FillRect
EnumWindows
EndPaint
EnableWindow
EmptyClipboard
DrawTextA
DrawIconEx
DrawFrameControl
DrawFocusRect
DispatchMessageW
DestroyWindow
DefWindowProcA
DefWindowProcW
CloseClipboard
CallWindowProcW
BringWindowToTop
BeginPaint
AttachThreadInput

gdi32

TextOutA
StartPage
StartDocA
SetTextColor
SetMapMode
SetBkMode
SetBkColor
SelectObject
SelectClipRgn
MoveToEx
LineTo
GetTextMetricsW
GetTextFaceA
GetTextExtentPoint32A
GetStockObject
GetRgnBox
GetObjectW
GetDeviceCaps
GdiFlush
EndPage
EndDoc
DeleteObject
DeleteDC
CreateSolidBrush
CreateRectRgnIndirect
CreatePen
CreateFontA
CreateFontW
CreateDIBSection
CreateDCW
CreateCompatibleDC
CombineRgn
BitBlt

advapi32

SetSecurityDescriptorDacl
RegSetValueExA
RegQueryValueExA
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExA
RegOpenKeyExW
RegEnumKeyA
RegDeleteValueA
RegCreateKeyExA
RegCloseKey
InitializeSecurityDescriptor
GetUserNameA
FreeSid
AllocateAndInitializeSid

madbasic_.bpl

@Madtypes@MadException@$bctr$qqrx20System@UnicodeString
@$xp$21Madtypes@MadException
@Madtypes@MadException@
@$xp$25Madtypes@TDAUnicodeString
@$xp$22Madtypes@TDAAnsiString
@$xp$19Madtypes@TDAInteger
@$xp$20Madtypes@TDACardinal
@$xp$20Madtypes@TDASmallInt
@Madstrings@initialization$qqrv
@Madstrings@Finalization$qqrv
@Madstrings@SizeToStr$qqrj
@Madstrings@SubTextExists$qqrx27System@%AnsiStringT$us$i0$%t1c
@Madstrings@SubStrExists$qqrx27System@%AnsiStringT$us$i0$%t1c
@Madstrings@SubStr$qqrx27System@%AnsiStringT$us$i0$%uic
@Madstrings@SubStrCount$qqrx27System@%AnsiStringT$us$i0$%c
@Madstrings@FormatSubStrs$qqrr27System@%AnsiStringT$us$i0$%c
@Madstrings@StrToIntEx$qqropci
@Madstrings@IntToHexEx$qqrjic
@Madstrings@IntToHexEx$qqruiic
@Madstrings@IntToStrEx$qqrjic
@Madstrings@IntToStrEx$qqruiic
@Madstrings@IntToHexEx$qqriic
@Madstrings@IntToStrEx$qqriic
@Madstrings@FillStr$qqrx20System@UnicodeStringib
@Madstrings@FillStr$qqrx27System@%AnsiStringT$us$i0$%ic
@Madstrings@PosChars$qqrrx29System@%Set$tc$iuc$0$iuc$255%x27System@%AnsiStringT$us$i0$%uiui
@Madstrings@PosTextIs1$qqrx20System@UnicodeStringt1
@Madstrings@PosTextIs1$qqrx27System@%AnsiStringT$us$i0$%t1
@Madstrings@PosStrIs1$qqrx20System@UnicodeStringt1
@Madstrings@PosStrIs1$qqrx27System@%AnsiStringT$us$i0$%t1
@Madstrings@PosPChar$qqrpct1uiuiouiui
@Madstrings@PosText$qqrx27System@%AnsiStringT$us$i0$%t1uiui
@Madstrings@PosStr$qqrx27System@%AnsiStringT$us$i0$%t1uiui
@Madstrings@CompareText$qqrx27System@%AnsiStringT$us$i0$%t1
@Madstrings@IsTextEqual$qqrx27System@%AnsiStringT$us$i0$%t1
@Madstrings@BooleanToChar$qqro
@Madstrings@LowStr$qqrx27System@%AnsiStringT$us$i0$%
@Madstrings@LowChar$qqrxc
@Madstrings@UpStr$qqrx27System@%AnsiStringT$us$i0$%
@Madstrings@UpChar$qqrxc
@Madstrings@CopyR$qqrx27System@%AnsiStringT$us$i0$%ui
@Madstrings@Keep$qqrr27System@%AnsiStringT$us$i0$%uiui
@Madstrings@RetDelete$qqrx20System@UnicodeStringuiui
@Madstrings@RetDelete$qqrx27System@%AnsiStringT$us$i0$%uiui
@Madstrings@ReplaceText$qqrr27System@%AnsiStringT$us$i0$%x27System@%AnsiStringT$us$i0$%t2o
@Madstrings@ReplaceStr$qqrr27System@%AnsiStringT$us$i0$%x27System@%AnsiStringT$us$i0$%t2o
@Madstrings@KillChars$qqrr27System@%AnsiStringT$us$i0$%rx29System@%Set$tc$iuc$0$iuc$255%
@Madstrings@KillChar$qqrr27System@%AnsiStringT$us$i0$%c
@Madstrings@RetTrimStr$qqrx27System@%AnsiStringT$us$i0$%
@Madstrings@TrimStr$qqrr27System@%AnsiStringT$us$i0$%
@Madtools@initialization$qqrv
@Madtools@Finalization$qqrv
@Madtools@InitTryExceptFinally$qqrv
@Madtools@TickDif$qqrui
@Madtools@Unmangle$qqrr27System@%AnsiStringT$us$i0$%t1
@Madtools@ResToStr$qqruipct2
@Madtools@GetImageProcName$qqruipvo
@Madtools@GetImageProcAddress$qqruix27System@%AnsiStringT$us$i0$%o
@Madtools@GetImageExportDirectory$qqrui
@Madtools@GetImageNtHeaders$qqrui
@Madtools@FindModule$qqrpvruir27System@%AnsiStringT$us$i0$%
@Madtools@DelMsgHandler$qqrpqqruiuiiiri$vuiui
@Madtools@AddMsgHandler$qqrpqqruiuiiiri$vuiui
@Madtools@MsgHandlerWindow$qqrui
@Madtools@MethodToProcedure$qqrp14System@TObjectpv
@Madtools@FileVersionToStr$qqrj
@Madtools@GetFileVersion$qqrx20System@UnicodeString
@Madtools@GetFileVersion$qqrx27System@%AnsiStringT$us$i0$%
@Madtools@GetFreeSystemResources$qqrus
@Madtools@OS$qqrv
@$xp$12Madtools@TOS
@Madzip@Zip$qqr20System@UnicodeStringpx20System@UnicodeStringxix45System@%DynamicArray$t20System@UnicodeString%
@Madzip@UpdateCrc32$qqruipxvi
@Madzip@Uncompress$qqr27System@%AnsiStringT$us$i0$%
@Madzip@Compress$qqr27System@%AnsiStringT$us$i0$%o
@Madzip@Compress$qqrpvt1ii
@Madcrypt@Decode$qqr27System@%AnsiStringT$us$i0$%
@Madcrypt@Encode$qqr27System@%AnsiStringT$us$i0$%
@Madcrypt@Encode$qqrpci
@Madcrypt@OldDecrypt$qqrr27System@%AnsiStringT$us$i0$%27System@%AnsiStringT$us$i0$%
@Madcrypt@OldEncrypt$qqrr27System@%AnsiStringT$us$i0$%27System@%AnsiStringT$us$i0$%
@Madcrypt@Decrypt$qqrr27System@%AnsiStringT$us$i0$%x27System@%AnsiStringT$us$i0$%j

maddisasm_.bpl

@Maddisasm@initialization$qqrv
@Maddisasm@Finalization$qqrv
@Maddisasm@TryRead$qqrpvt1iui
@Maddisasm@EndTryRead$qqrui
@Maddisasm@StartTryRead$qqrv
@Maddisasm@Magic95$qqrv
@Maddisasm@Magic$qqrv
@Maddisasm@ParseFunctionEx$qqrpvr27System@%AnsiStringT$us$i0$%t1io
@Maddisasm@ParseFunction$qqrpv
@Maddisasm@ParseFunction_$qqrpvuit1t1t1t1t1
@Maddisasm@ParseCode_$qqrpvui
@Maddisasm@ParseCode$qqrpv
@Maddisasm@BcbInitExceptBlockLDTC
@Maddisasm@GetLineNumber
@Maddisasm@GetProcNameFromMapFile
@$xp$23Maddisasm@TFunctionInfo
@$xp$27Maddisasm@_TFunctionInfo@_6

comctl32

ImageList_Destroy
ImageList_Create
InitCommonControls

comdlg32

PrintDlgW
GetSaveFileNameA

shell32

ShellExecuteExA
ShellExecuteA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHGetMalloc

wsock32

WSACleanup
WSAStartup
gethostbyname
socket
setsockopt
sendto
send
select
recvfrom
recv
inet_addr
htons
connect
closesocket
bind

Exports

Exports

@$xp$19Madexcept@IMEFields
@$xp$19Madexcept@TMEButton
@$xp$19Madexcept@TMEDupDef
@$xp$19Madexcept@TSyncType
@$xp$19Madmapfile@TMapFile
@$xp$20Madmapfile@TMfPublic
@$xp$21Madexcept@IMESettings
@$xp$21Madexcept@TExceptType
@$xp$21Madmapfile@TMfSegment
@$xp$21Madnvbitmap@INVBitmap
@$xp$22Madexcept@IMEException
@$xp$22Madexcept@Madexcept__1
@$xp$22Madexcept@Madexcept__2
@$xp$22Madexcept@TExceptPhase
@$xp$22Madnvassistant@INVEdit
@$xp$22Madnvassistant@INVForm
@$xp$22Madnvassistant@INVItem
@$xp$22Madnvbitmap@TPngFormat
@$xp$23Madexcept@TExceptAction
@$xp$23Madexcept@TExceptSource
@$xp$23Madmapfile@_TMapFile@_1
@$xp$23Madmapfile@_TMapFile@_2
@$xp$23Madmapfile@_TMapFile@_3
@$xp$23Madnvassistant@INVImage
@$xp$23Madnvassistant@INVLabel
@$xp$24Madexcept@IMEAttachments
@$xp$24Madexcept@TExceptEventOO
@$xp$24Madexcept@TMEShowSetting
@$xp$24Madnvassistant@INVButton
@$xp$24Madnvassistant@TNVAction
@$xp$24Madstacktrace@TStackItem
@$xp$25Madstacktrace@TStackTrace
@$xp$26Madnvassistant@INVCheckBox
@$xp$26Madnvassistant@TOutputType
@$xp$27Madexcept@IMEModuleSettings
@$xp$27Madnvassistant@INVAssistant
@$xp$28Madstacktrace@BcbTermination
@$xp$29Madnvassistant@TNVModalResult
@$xp$29Madnvprgralert@IProgressAlert
@$xp$29Madstacktrace@TDAPreStackItem
@$xp$30Madexcept@TBugReportCallbackOO
@$xp$30Madexcept@TExceptActionEventOO
@GetPackageInfoTable
@Maddumpobj@DumpObj$qqrp14System@TObject
@Maddumpobj@Finalization$qqrv
@Maddumpobj@initialization$qqrv
@Madexcept@AddCmdLineToBugRep
@Madexcept@AmHttpServer
@Madexcept@AmOnline$qqro
@Madexcept@AutoSaveBugReport$qqr27System@%AnsiStringT$us$i0$%49System@%DelphiInterface$t21Madexcept@IMESettings%
@Madexcept@AutoSendBugReport$qqr27System@%AnsiStringT$us$i0$%49System@%DelphiInterface$t21Madnvbitmap@INVBitmap%49System@%DelphiInterface$t21Madexcept@IMESettings%
@Madexcept@BcbCallTerminate
@Madexcept@BcbExceptionHandler
@Madexcept@BcbHelper_GetIntraWebVersion$qqrpv
@Madexcept@BcbInitExceptBlockLDTC
@Madexcept@BcbMemcpy
@Madexcept@BcbOrgMalloc
@Madexcept@BcbPTerminate
@Madexcept@BcbThrowExceptionLDTC
@Madexcept@BugReportHtml
@Madexcept@CGIApp_TCGIApplication_CGIHandleException
@Madexcept@CMadExceptVersionString
@Madexcept@CalibrateCode$qqrv
@Madexcept@CalibrateData
@Madexcept@CheckExceptParams$qqrrp14System@TObjectrpvt2rp8_CONTEXT
@Madexcept@Classes_CheckSynchronize
@Madexcept@CloseAntiFreeze$qqrv
@Madexcept@CloseAppExitCode
@Madexcept@CloseApplication$qqrv
@Madexcept@CreateBugReport$qqr21Madexcept@TExceptTypep14System@TObjectpvuiuiuip8_CONTEXTo55System@%DelphiInterface$t27Madexcept@IMEModuleSettings%23Madexcept@TExceptSourcet2uit3
@Madexcept@DecryptPassword$qqr27System@%AnsiStringT$us$i0$%t1t1
@Madexcept@DefaultBugReportHtml$qqr27System@%AnsiStringT$us$i0$%49System@%DelphiInterface$t21Madexcept@IMESettings%
@Madexcept@DetectConsole
@Madexcept@DisAsmFunc
@Madexcept@DontReformatExcMsg
@Madexcept@DontUseProxy
@Madexcept@DumbStackTrace
@Madexcept@Ebp$qqrv
@Madexcept@Esp$qqrv
@Madexcept@ExpandVars$qqruir27System@%AnsiStringT$us$i0$%27System@%AnsiStringT$us$i0$%t3
@Madexcept@FillClipboard$qqr27System@%AnsiStringT$us$i0$%
@Madexcept@Finalization$qqrv
@Madexcept@ForceUtf8
@Madexcept@FormatExceptMessage$qqr27System@%AnsiStringT$us$i0$%
@Madexcept@Forms_TApplication_HandleException
@Madexcept@Forms_TApplication_ShowException
@Madexcept@Get9xResourceReport$qqrv
@Madexcept@GetAllocatedMemory$qqrv
@Madexcept@GetCpuCount$qqrv
@Madexcept@GetCpuName$qqrv
@Madexcept@GetCrashStackTrace$qqrooop49System@%DynamicArray$t24Madstacktrace@TStackItem%57System@%DelphiInterface$t29Madnvprgralert@IProgressAlert%opuit7pop52System@%DynamicArray$t27System@%AnsiStringT$us$i0$%%
@Madexcept@GetDisplayModeString$qqrv
@Madexcept@GetExceptBoxHandle$qqrv
@Madexcept@GetMemoryStatus$qqrv
@Madexcept@GetOsLanguageString$qqrv
@Madexcept@GetOsVersionString$qqrv
@Madexcept@GetProgramUpTime$qqrv
@Madexcept@GetSystemUpTime$qqrv
@Madexcept@GetTSClientName$qqrv
@Madexcept@GetThreadCreatorAddr$qqrui
@Madexcept@GetThreadInfos$qqruiruit2t2t2riro
@Madexcept@GetThreadList$qqrv
@Madexcept@GetThreadName$qqrui
@Madexcept@GetThreadStackTrace$qqruiooop49System@%DynamicArray$t24Madstacktrace@TStackItem%57System@%DelphiInterface$t29Madnvprgralert@IProgressAlert%opuit8pop52System@%DynamicArray$t27System@%AnsiStringT$us$i0$%%
@Madexcept@HandleContactForm$qqr50System@%DelphiInterface$t22Madnvassistant@INVForm%24Madnvassistant@TNVAction50System@%DelphiInterface$t22Madnvassistant@INVItem%50System@%DelphiInterface$t22Madexcept@IMEException%
@Madexcept@HandleException$qqr21Madexcept@TExceptTypep14System@TObjectpvouiuip8_CONTEXT23Madexcept@TExceptSourcet2uip27System@%AnsiStringT$us$i0$%
@Madexcept@HandleScreenshotForm$qqr50System@%DelphiInterface$t22Madnvassistant@INVForm%24Madnvassistant@TNVAction50System@%DelphiInterface$t22Madnvassistant@INVItem%50System@%DelphiInterface$t22Madexcept@IMEException%
@Madexcept@HiddenAutoMailing
@Madexcept@HttpExtensionProcNext
@Madexcept@HttpUpload$qqr27System@%AnsiStringT$us$i0$%52System@%DelphiInterface$t24Madexcept@IMEAttachments%47System@%DelphiInterface$t19Madexcept@IMEFields%t1t1uit1uioo49System@%DelphiInterface$t21Madexcept@IMESettings%
@Madexcept@HttpUploadTimeout
@Madexcept@HyperJumpCallstack$qqr27System@%AnsiStringT$us$i0$%
@Madexcept@ISAPIApp_TISAPIApplication_ISAPIHandleException
@Madexcept@ImNotFrozen$qqrv
@Madexcept@InitAntiFreeze$qqrv
@Madexcept@InstallUnhandledExceptionFilter$qqrv
@Madexcept@IsThreadSuspended$qqruiui
@Madexcept@IsUserAdmin$qqrv
@Madexcept@MESettings$qqrpv
@Madexcept@MESettings$qqrui
@Madexcept@MESettings$qqrv
@Madexcept@MxLookup$qqr27System@%AnsiStringT$us$i0$%
@Madexcept@NameThread$qqrui27System@%AnsiStringT$us$i0$%
@Madexcept@NewAttachments$qqrv
@Madexcept@NewException$qqr21Madexcept@TExceptTypep14System@TObjectpvouiuiuip8_CONTEXT55System@%DelphiInterface$t27Madexcept@IMEModuleSettings%23Madexcept@TExceptSourcet2uit3o
@Madexcept@NewFields$qqrv
@Madexcept@NoOnlineCheck
@Madexcept@OnExceptBoxCreate
@Madexcept@OpenThread$qqruiui
@Madexcept@PatchInt$qqrpvi
@Madexcept@PatchJmp$qqrpvt1
@Madexcept@PauseFreezeCheck$qqro
@Madexcept@PauseMadExcept$qqro
@Madexcept@PauseMeEventually$qqrv
@Madexcept@Plugins
@Madexcept@PrintBugReport$qqr27System@%AnsiStringT$us$i0$%ui49System@%DelphiInterface$t21Madexcept@IMESettings%
@Madexcept@ProcessMainThreadId
@Madexcept@ProxyServer
@Madexcept@PutAssisIntoBugReport$qqr55System@%DelphiInterface$t27Madnvassistant@INVAssistant%50System@%DelphiInterface$t22Madexcept@IMEException%
@Madexcept@Qforms_TApplication_HandleException
@Madexcept@Qforms_TApplication_ShowException
@Madexcept@RegDelVal$qqrui27System@%AnsiStringT$us$i0$%t2
@Madexcept@RegReadStr$qqrui27System@%AnsiStringT$us$i0$%t2
@Madexcept@RegWriteStr$qqrui27System@%AnsiStringT$us$i0$%t2t2
@Madexcept@RegisterBugReportPlugin$qqr27System@%AnsiStringT$us$i0$%t1pqqrv$20System@UnicodeStringo
@Madexcept@RegisterBugReportPlugin$qqr27System@%AnsiStringT$us$i0$%t1pqqrv$27System@%AnsiStringT$us$i0$%o
@Madexcept@RegisterBugReportPlugin$qqr27System@%AnsiStringT$us$i0$%t1pqqrx50System@%DelphiInterface$t22Madexcept@IMEException%$20System@UnicodeStringo
@Madexcept@RegisterBugReportPlugin$qqr27System@%AnsiStringT$us$i0$%t1pqqrx50System@%DelphiInterface$t22Madexcept@IMEException%$27System@%AnsiStringT$us$i0$%o
@Madexcept@RegisterExceptActionHandler$qqrpqqr23Madexcept@TExceptActionx50System@%DelphiInterface$t22Madexcept@IMEException%ro$v19Madexcept@TSyncType
@Madexcept@RegisterExceptActionHandler$qqrynpqqr23Madexcept@TExceptActionx50System@%DelphiInterface$t22Madexcept@IMEException%ro$v19Madexcept@TSyncType
@Madexcept@RegisterExceptionHandler$qqrpqqrx50System@%DelphiInterface$t22Madexcept@IMEException%ro$v19Madexcept@TSyncType22Madexcept@TExceptPhase
@Madexcept@RegisterExceptionHandler$qqrynpqqrx50System@%DelphiInterface$t22Madexcept@IMEException%ro$v19Madexcept@TSyncType22Madexcept@TExceptPhase
@Madexcept@RegisterHiddenExceptionHandler$qqrpqqrx50System@%DelphiInterface$t22Madexcept@IMEException%ro$v19Madexcept@TSyncType
@Madexcept@RegisterHiddenExceptionHandler$qqrynpqqrx50System@%DelphiInterface$t22Madexcept@IMEException%ro$v19Madexcept@TSyncType
@Madexcept@ResetFpuMode
@Madexcept@RestartApplication$qqrv
@Madexcept@SaveBugReport$qqr27System@%AnsiStringT$us$i0$%ui49System@%DelphiInterface$t21Madexcept@IMESettings%
@Madexcept@SendBugReport$qqr27System@%AnsiStringT$us$i0$%49System@%DelphiInterface$t21Madnvbitmap@INVBitmap%ui49System@%DelphiInterface$t21Madexcept@IMESettings%
@Madexcept@SendMapiMail$qqr27System@%AnsiStringT$us$i0$%t1t152System@%DelphiInterface$t24Madexcept@IMEAttachments%uioo49System@%DelphiInterface$t21Madexcept@IMESettings%
@Madexcept@SendShellMail$qqr27System@%AnsiStringT$us$i0$%t1t1
@Madexcept@SendSmtpMail$qqr27System@%AnsiStringT$us$i0$%t1t1t152System@%DelphiInterface$t24Madexcept@IMEAttachments%t1t1t1uiuioo49System@%DelphiInterface$t21Madexcept@IMESettings%
@Madexcept@SetFreezeTimeout$qqrui
@Madexcept@SetTopmost$qqruio
@Madexcept@ShowBugReportKey
@Madexcept@SmtpMailFrom
@Madexcept@SysUtils_InitializePackage
@Madexcept@SysUtils_LoadPackage
@Madexcept@SysUtils_ShowException
@Madexcept@System_ExceptionHandler
@Madexcept@System_FinalizeUnits
@Madexcept@System_InitUnits
@Madexcept@System_runErrMsg
@Madexcept@UnregisterBugReportPlugin$qqr27System@%AnsiStringT$us$i0$%
@Madexcept@UnregisterExceptActionHandler$qqrpqqr23Madexcept@TExceptActionx50System@%DelphiInterface$t22Madexcept@IMEException%ro$v
@Madexcept@UnregisterExceptActionHandler$qqrynpqqr23Madexcept@TExceptActionx50System@%DelphiInterface$t22Madexcept@IMEException%ro$v
@Madexcept@UnregisterExceptionHandler$qqrpqqrx50System@%DelphiInterface$t22Madexcept@IMEException%ro$v
@Madexcept@UnregisterExceptionHandler$qqrynpqqrx50System@%DelphiInterface$t22Madexcept@IMEException%ro$v
@Madexcept@UnregisterHiddenExceptionHandler$qqrpqqrx50System@%DelphiInterface$t22Madexcept@IMEException%ro$v
@Madexcept@UnregisterHiddenExceptionHandler$qqrynpqqrx50System@%DelphiInterface$t22Madexcept@IMEException%ro$v
@Madexcept@initialization$qqrv
@Madexcept@madTraceProcess$qqsi
@Madexcept_@@GetPackageInfoTable$qqrv
@Madexcept_@@PackageLoad$qqrv
@Madexcept_@@PackageUnload$qqrv
@Madexcept_@initialization$qqrv
@Madlinkdisasm@Finalization$qqrv
@Madlinkdisasm@initialization$qqrv
@Madlisthardware@Finalization$qqrv
@Madlisthardware@GetHardwareList$qqrv
@Madlisthardware@initialization$qqrv
@Madlistmodules@Finalization$qqrv
@Madlistmodules@GetModuleList$qqrv
@Madlistmodules@initialization$qqrv
@Madlistprocesses@Finalization$qqrv
@Madlistprocesses@GetProcessList$qqrv
@Madlistprocesses@initialization$qqrv
@Madmapfile@CMapFileStreamDescriptor
@Madmapfile@Finalization$qqrv
@Madmapfile@FindMapFile$qqrpv
@Madmapfile@GetMapFileInfos$qqrpvr27System@%AnsiStringT$us$i0$%t2t2rpvri
@Madmapfile@GetMyProcName$qqro
@Madmapfile@LoadMapFile$qqr27System@%AnsiStringT$us$i0$%o
@Madmapfile@LoadMapFileEx$qqr27System@%AnsiStringT$us$i0$%o
@Madmapfile@TMapFile@
@Madmapfile@TMapFile@$bctr$qqro27System@%AnsiStringT$us$i0$%uioo
@Madmapfile@TMapFile@Export$qqrooo
@Madmapfile@TMapFile@FindLine$qqrpv
@Madmapfile@TMapFile@FindLine$qqrpvrpv
@Madmapfile@TMapFile@FindPublic$qqri
@Madmapfile@TMapFile@FindPublic$qqro27System@%AnsiStringT$us$i0$%t2o
@Madmapfile@TMapFile@FindPublic$qqrpv
@Madmapfile@TMapFile@FindSegment$qqri
@Madmapfile@TMapFile@FindSegment$qqropv
@Madmapfile@initialization$qqrv
@Madnvassistant@CreateAssistant$qqr27System@%AnsiStringT$us$i0$%px27System@%AnsiStringT$us$i0$%xi45System@%DelphiInterface$t17System@IInterface%
@Madnvassistant@Finalization$qqrv
@Madnvassistant@HandleContactFormProc
@Madnvassistant@HandleScreenshotFormProc
@Madnvassistant@LoadAssistant$qqrui27System@%AnsiStringT$us$i0$%px27System@%AnsiStringT$us$i0$%xi45System@%DelphiInterface$t17System@IInterface%
@Madnvassistant@OnAssistantCreate
@Madnvassistant@initialization$qqrv
@Madnvbitmap@Finalization$qqrv
@Madnvbitmap@LoadBitmap$qqr27System@%AnsiStringT$us$i0$%
@Madnvbitmap@ScreenShot$qqro
@Madnvbitmap@initialization$qqrv
@Madnvprgralert@Finalization$qqrv
@Madnvprgralert@NewProgressAlert$qqr27System@%AnsiStringT$us$i0$%uit1
@Madnvprgralert@initialization$qqrv
@Madstacktrace@BcbTermination@
@Madstacktrace@FastMM_LogStackTrace$qqrpvipcoooo
@Madstacktrace@Finalization$qqrv
@Madstacktrace@InternalError$qqr27System@%AnsiStringT$us$i0$%oo
@Madstacktrace@PrepareStackTrace$qqruiuiuipvor52System@%DynamicArray$t27Madstacktrace@TPreStackItem%
@Madstacktrace@StackAddrToStr$qqrpvoo
@Madstacktrace@StackTrace$qqrooop49System@%DynamicArray$t24Madstacktrace@TStackItem%pvoouiuit5ppvtbtb57System@%DelphiInterface$t29Madnvprgralert@IProgressAlert%uioot5popuitktjp52System@%DynamicArray$t27System@%AnsiStringT$us$i0$%%o
@Madstacktrace@initialization$qqrv
Finalize
Initialize
madTraceProcess

Sections

.text
Size: 264KB - Virtual size: 264KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 180B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 34B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fa5ffeafc713c08acec41a7699705f80

Code Sign

4f:63:d0:30:f8:15:a3:a5:b3:44:69:40:06:3d:16:89Certificate

Extended Key Usages

Key Usages

91:d9:a0:84:0b:6c:b0:65:f7:40:9e:d4:29:f9:76:e2Certificate

Extended Key Usages

Key Usages

3b:53:7f:64:24:e5:83:05:21:b1:3e:3c:41:07:70:03:65:63:10:cdSigner

Headers

File Characteristics

Imports

rtl120.bpl

kernel32

user32

gdi32

advapi32

madbasic_.bpl

maddisasm_.bpl

comctl32

comdlg32

shell32

wsock32

Exports

Exports

Sections

.text Size: 264KB - Virtual size: 264KB

.itext Size: 1024B - Virtual size: 588B

.data Size: 3KB - Virtual size: 2KB

.bss Size: - Virtual size: 180B

.idata Size: 22KB - Virtual size: 21KB

.edata Size: 15KB - Virtual size: 14KB

.rdata Size: 512B - Virtual size: 34B

.reloc Size: 13KB - Virtual size: 12KB

.rsrc Size: 12KB - Virtual size: 12KB

4f:63:d0:30:f8:15:a3:a5:b3:44:69:40:06:3d:16:89
Certificate

91:d9:a0:84:0b:6c:b0:65:f7:40:9e:d4:29:f9:76:e2
Certificate

3b:53:7f:64:24:e5:83:05:21:b1:3e:3c:41:07:70:03:65:63:10:cd
Signer

.text
Size: 264KB - Virtual size: 264KB

.itext
Size: 1024B - Virtual size: 588B

.data
Size: 3KB - Virtual size: 2KB

.bss
Size: - Virtual size: 180B

.idata
Size: 22KB - Virtual size: 21KB

.edata
Size: 15KB - Virtual size: 14KB

.rdata
Size: 512B - Virtual size: 34B

.reloc
Size: 13KB - Virtual size: 12KB

.rsrc
Size: 12KB - Virtual size: 12KB