5d23b3d30e09e45681c157efaba58063a399f5a66cfe67f58b840583281a9f38

Sharing

Copy URL Twitter E-mail

General

Target
5d23b3d30e09e45681c157efaba58063a399f5a66cfe67f58b840583281a9f38
Size 138KB
Sample260808-vbg2qsed88
SHA256 5d23b3d30e09e45681c157efaba58063a399f5a66cfe67f58b840583281a9f38
MD5 42693cfddb394e645bfda07009cb6aa5
SHA1 f4157a5a62c9644166e30a140a911c76109bd108
SHA512 6eeb21f7abcaa758ea29c84bb92882ee8c850b8db0c3690946575b233dd65a79f4d96f4b8c6eee2e04ea8177e36fc38507b70c87bc59a41b515632385924c12f
SSDEEP 3072:2OBJZHrCQfc6Ee9NJgbr1usqYag1sEtl37npQ:2O/ZHmQfcg2VPag1Xz6
TLSH
T1E3D32811B244C075CDA1CC76482CE9F4522BFD2119F1886BB9E83F8AB935F546BEE217
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5d23b3d30e09e45681c157efaba58063a399f5a66cfe67f58b840583281a9f38

File Explorer

5d23b3d30e09e45681c157efaba58063a399f5a66cfe67f58b840583281a9f38

.exe 138KB

5d23b3d30e09e45681c157efaba58063a399f5a66cfe67f58b840583281a9f38

IMPHASH bbdbc99f283fb6d818223ebfb5a75f04
SHA256 5d23b3d30e09e45681c157efaba58063a399f5a66cfe67f58b840583281a9f38
MD5 42693cfddb394e645bfda07009cb6aa5
SHA1 f4157a5a62c9644166e30a140a911c76109bd108
SHA512 6eeb21f7abcaa758ea29c84bb92882ee8c850b8db0c3690946575b233dd65a79f4d96f4b8c6eee2e04ea8177e36fc38507b70c87bc59a41b515632385924c12f
SSDEEP 3072:2OBJZHrCQfc6Ee9NJgbr1usqYag1sEtl37npQ:2O/ZHmQfcg2VPag1Xz6
TLSH
T1E3D32811B244C075CDA1CC76482CE9F4522BFD2119F1886BB9E83F8AB935F546BEE217
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

49868

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

rtl120.bpl

@System@initialization$qqrv @System@Finalization$qqrv @System@@IntfCopy$qqrr45System@%DelphiInterface$t17System@IInterface%x45System@%DelphiInterface$t17System@IInterface% @System@@IntfClear$qqrr45System@%DelphiInterface$t17System@IInterface% @System@RegisterModule$qqrp17System@TLibModule @System@@DynArrayClear$qqrrpvpv @System@@DynArraySetLength$qqrv @System@@DynArrayHigh$qqrv @System@@DynArrayLength$qqrv @System@@_lludiv$qqrv @System@@_llmul$qqrv @System@@Dispose$qqrpvt1 @System@@CopyRecord$qqrv @System@@FinalizeArray$qqrpvt1ui @System@@FinalizeRecord$qqrpvt1 @System@Pos$qqrx20System@UnicodeStringt1 @System@@UniqueStringU$qqrr20System@UnicodeString @System@@UStrInsert$qqrx20System@UnicodeStringr20System@UnicodeStringi @System@@UStrDelete$qqrr20System@UnicodeStringii @System@@UStrCopy$qqrx20System@UnicodeStringii @System@@UStrEqual$qqrv @System@@UStrCatN$qqrv @System@@UStrCat3$qqrr20System@UnicodeStringx20System@UnicodeStringt2 @System@@UStrCat$qqrr20System@UnicodeStringx20System@UnicodeString @System@@UStrSetLength$qqrr20System@UnicodeStringi @System@@UStrLen$qqrx20System@UnicodeString @System@@UStrFromWStr$qqrr20System@UnicodeStringx17System@WideString @System@@UStrFromLStr$qqrr20System@UnicodeStringx27System@%AnsiStringT$us$i0$% @System@@UStrFromWArray$qqrr20System@UnicodeStringpbi @System@@UStrFromPWChar$qqrr20System@UnicodeStringpb @System@@UStrFromWChar$qqrr20System@UnicodeStringb @System@@UStrFromPWCharLen$qqrr20System@UnicodeStringpbi @System@@UStrToPWChar$qqrx20System@UnicodeString @System@@UStrLAsg$qqrr20System@UnicodeStringx20System@UnicodeString @System@@UStrAsg$qqrr20System@UnicodeStringx20System@UnicodeString @System@@UStrArrayClr$qqrpvi @System@@UStrClr$qqrpv @System@@UStrAddRef$qqrpv @System@@WStrSetLength$qqrr17System@WideStringi @System@@WStrToPWChar$qqrx17System@WideString @System@@WStrClr$qqrpv @System@@LStrSetLength$qqrv @System@@UniqueStringA$qqrr27System@%AnsiStringT$us$i0$% @System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$% @System@@LStrAddRef$qqrpv @System@@LStrCatN$qqrv @System@@LStrFromPWChar$qqrr27System@%AnsiStringT$us$i0$%pbus @System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us @System@@EnsureUnicodeString$qqrr20System@UnicodeString @System@@LStrArrayClr$qqrpvi @System@@LStrClr$qqrpv @System@@Halt0$qqrv @System@@StartExe$qqrp23System@PackageInfoTablep17System@TLibModule @System@@TryFinallyExit$qqrv @System@@DoneExcept$qqrv @System@@RaiseAgain$qqrv @System@@HandleFinally$qqrv @System@@HandleOnException$qqrv @System@@HandleAnyException$qqrv @System@@BeforeDestruction$qqrp14System@TObjectzc @System@@AfterConstruction$qqrp14System@TObject @System@@ClassDestroy$qqrp14System@TObject @System@@ClassCreate$qqrp17System@TMetaClasso @System@TObject@Dispatch$qqrpv @System@TObject@BeforeDestruction$qqrv @System@TObject@AfterConstruction$qqrv @System@TObject@DefaultHandler$qqrpv @System@TObject@ToString$qqrv @System@TObject@SafeCallException$qqrp14System@TObjectpv @System@@IsClass$qqrp14System@TObjectp17System@TMetaClass @System@TObject@GetHashCode$qqrv @System@TObject@Equals$qqrp14System@TObject @System@TObject@Free$qqrv @System@TObject@$bdtr$qqrv @System@TObject@$bctr$qqrv @System@TObject@FreeInstance$qqrv @System@TObject@NewInstance$qqrv @System@@FillChar$qqrpvib @System@@ROUND$qqrv @System@ParamStr$qqri @System@Move$qqrpxvpvi @System@@FreeMem$qqrpv @System@@GetMem$qqri @System@TObject@ @$xp$13System@string @Sysutils@initialization$qqrv @Sysutils@Finalization$qqrv @Sysutils@TEncoding@GetUnicode$qqrv @Sysutils@GetEnvironmentVariable$qqrx20System@UnicodeString @Sysutils@FreeAndNil$qqrpv @Sysutils@GetModuleName$qqrui @Sysutils@StringReplace$qqrx20System@UnicodeStringt1t149System@%Set$t21Sysutils@Sysutils__15$iuc$0$iuc$1% @Sysutils@GetLocaleFormatSettings$qqrir24Sysutils@TFormatSettings @Sysutils@AnsiPos$qqrx20System@UnicodeStringt1 @Sysutils@IncludeTrailingPathDelimiter$qqrx20System@UnicodeString @Sysutils@StrToDateTime$qqrx20System@UnicodeStringrx24Sysutils@TFormatSettings @Sysutils@FormatDateTime$qqrx20System@UnicodeString16System@TDateTime @Sysutils@Now$qqrv @Sysutils@StrToFloat$qqrx20System@UnicodeStringrx24Sysutils@TFormatSettings @Sysutils@StrToFloat$qqrx20System@UnicodeString @Sysutils@FloatToStr$qqrgrx24Sysutils@TFormatSettings @Sysutils@FloatToStr$qqrg @Sysutils@StrDispose$qqrpb @Sysutils@StrAlloc$qqrui @Sysutils@StrLen$qqrpxb @Sysutils@ExtractFileName$qqrx20System@UnicodeString @Sysutils@ExtractFileDrive$qqrx20System@UnicodeString @Sysutils@ExtractFileDir$qqrx20System@UnicodeString @Sysutils@ExtractFilePath$qqrx20System@UnicodeString @Sysutils@ChangeFileExt$qqrx20System@UnicodeStringt1 @Sysutils@RenameFile$qqrx20System@UnicodeStringt1 @Sysutils@DeleteFile$qqrx20System@UnicodeString @Sysutils@FileIsReadOnly$qqrx20System@UnicodeString @Sysutils@FileSetAttr$qqrx20System@UnicodeStringi @Sysutils@FileGetAttr$qqrx20System@UnicodeString @Sysutils@ForceDirectories$qqr20System@UnicodeString @Sysutils@DirectoryExists$qqrx20System@UnicodeString @Sysutils@FileExists$qqrx20System@UnicodeString @Sysutils@IntToStr$qqri @Sysutils@Trim$qqrx20System@UnicodeString @Sysutils@AnsiUpperCase$qqrx20System@UnicodeString @Sysutils@SameText$qqrx20System@UnicodeStringt1 @Sysutils@CompareText$qqrx20System@UnicodeStringt1 @Sysutils@UpperCase$qqrx20System@UnicodeString @Sysutils@CharInSet$qqrbrx29System@%Set$tc$iuc$0$iuc$255% @$xp$24Sysutils@TFormatSettings @Sysutils@TwoDigitYearCenturyWindow @Sysutils@Win32MinorVersion @Sysutils@Win32MajorVersion @Sysutils@EConvertError@ @Sysutils@EInOutError@ @Sysutils@Exception@ @$xp$15Sysutils@TBytes @Classes@initialization$qqrv @Classes@Finalization$qqrv @Classes@TFileStream@$bctr$qqrx20System@UnicodeStringus @Classes@TStream@WriteBuffer$qqrpxvi @Classes@TStream@SetSize64$qqrxj @Classes@TStream@SetPosition$qqrxj @Classes@TStringList@SetCaseSensitive$qqrxo @Classes@TStringList@$bctr$qqrv @Classes@TStringList@CompareStrings$qqrx20System@UnicodeStringt1 @Classes@TStringList@CustomSort$qqrpqqrp19Classes@TStringListii$i @Classes@TStringList@Sort$qqrv @Classes@TStringList@SetUpdateState$qqro @Classes@TStringList@SetCapacity$qqri @Classes@TStringList@PutObject$qqrip14System@TObject @Classes@TStringList@Put$qqrix20System@UnicodeString @Classes@TStringList@InsertItem$qqrix20System@UnicodeStringp14System@TObject @Classes@TStringList@InsertObject$qqrix20System@UnicodeStringp14System@TObject @Classes@TStringList@Insert$qqrix20System@UnicodeString @Classes@TStringList@GetObject$qqri @Classes@TStringList@GetCount$qqrv @Classes@TStringList@GetCapacity$qqrv @Classes@TStringList@Get$qqri @Classes@TStringList@Find$qqrx20System@UnicodeStringri @Classes@TStringList@Exchange$qqrii @Classes@TStringList@Delete$qqri @Classes@TStringList@Clear$qqrv @Classes@TStringList@Changing$qqrv @Classes@TStringList@AddObject$qqrx20System@UnicodeStringp14System@TObject @Classes@TStringList@Add$qqrx20System@UnicodeString @Classes@TStrings@GetNameValueSeparator$qqrv @Classes@TStrings@SetTextStr$qqrx20System@UnicodeString @Classes@TStrings@SetText$qqrpb @Classes@TStrings@SaveToStream$qqrp15Classes@TStreamp18Sysutils@TEncoding @Classes@TStrings@SaveToStream$qqrp15Classes@TStream @Classes@TStrings@SaveToFile$qqrx20System@UnicodeStringp18Sysutils@TEncoding @Classes@TStrings@SaveToFile$qqrx20System@UnicodeString @Classes@TStrings@Move$qqrii @Classes@TStrings@LoadFromStream$qqrp15Classes@TStreamp18Sysutils@TEncoding @Classes@TStrings@LoadFromStream$qqrp15Classes@TStream @Classes@TStrings@LoadFromFile$qqrx20System@UnicodeStringp18Sysutils@TEncoding @Classes@TStrings@LoadFromFile$qqrx20System@UnicodeString @Classes@TStrings@IndexOfObject$qqrp14System@TObject @Classes@TStrings@GetTextStr$qqrv @Classes@TStrings@GetText$qqrv @Classes@TStrings@EndUpdate$qqrv @Classes@TStrings@DefineProperties$qqrp14Classes@TFiler @Classes@TStrings@BeginUpdate$qqrv @Classes@TStrings@Assign$qqrp19Classes@TPersistent @Classes@TStrings@AddStrings$qqrp16Classes@TStrings @Classes@TPersistent@AssignTo$qqrp19Classes@TPersistent @Classes@TFileStream@ @Classes@TStringList@ @Typinfo@initialization$qqrv @Typinfo@Finalization$qqrv @Variants@initialization$qqrv @Variants@Finalization$qqrv @Varutils@initialization$qqrv @Varutils@Finalization$qqrv @Registry@initialization$qqrv @Registry@Finalization$qqrv @Registry@TRegistry@KeyExists$qqrx20System@UnicodeString @Registry@TRegistry@ReadString$qqrx20System@UnicodeString @Registry@TRegistry@OpenKeyReadOnly$qqrx20System@UnicodeString @Registry@TRegistry@OpenKey$qqrx20System@UnicodeStringo @Registry@TRegistry@SetRootKey$qqrp6HKEY__ @Registry@TRegistry@CloseKey$qqrv @Registry@TRegistry@$bctr$qqrv @Registry@TRegistry@ @Inifiles@initialization$qqrv @Inifiles@Finalization$qqrv @Inifiles@TIniFile@DeleteKey$qqrx20System@UnicodeStringt1 @Inifiles@TIniFile@ReadSectionValues$qqrx20System@UnicodeStringp16Classes@TStrings @Inifiles@TIniFile@ReadSection$qqrx20System@UnicodeStringp16Classes@TStrings @Inifiles@TIniFile@$bdtr$qqrv @Inifiles@TMemIniFile@ReadString$qqrx20System@UnicodeStringt1t1 @Inifiles@TMemIniFile@ReadSectionValues$qqrx20System@UnicodeStringp16Classes@TStrings @Inifiles@TMemIniFile@ReadSections$qqrp16Classes@TStrings @Inifiles@TMemIniFile@ReadSection$qqrx20System@UnicodeStringp16Classes@TStrings @Inifiles@TMemIniFile@GetStrings$qqrp16Classes@TStrings @Inifiles@TMemIniFile@GetCaseSensitive$qqrv @Inifiles@TMemIniFile@EraseSection$qqrx20System@UnicodeString @Inifiles@TMemIniFile@Clear$qqrv @Inifiles@TMemIniFile@$bdtr$qqrv @Inifiles@TMemIniFile@$bctr$qqrx20System@UnicodeString @Inifiles@THashedStringList@IndexOfName$qqrx20System@UnicodeString @Inifiles@THashedStringList@IndexOf$qqrx20System@UnicodeString @Inifiles@THashedStringList@$bdtr$qqrv @Inifiles@THashedStringList@Changed$qqrv @Inifiles@TStringHash@Remove$qqrx20System@UnicodeString @Inifiles@TStringHash@Add$qqrx20System@UnicodeStringi @Inifiles@TCustomIniFile@ReadSections$qqrx20System@UnicodeStringp16Classes@TStrings @Inifiles@TCustomIniFile@WriteBinaryStream$qqrx20System@UnicodeStringt1p15Classes@TStream @Inifiles@TCustomIniFile@ReadBinaryStream$qqrx20System@UnicodeStringt1p15Classes@TStream @Inifiles@TCustomIniFile@ValueExists$qqrx20System@UnicodeStringt1 @Inifiles@TCustomIniFile@WriteTime$qqrx20System@UnicodeStringt116System@TDateTime @Inifiles@TCustomIniFile@WriteFloat$qqrx20System@UnicodeStringt1d @Inifiles@TCustomIniFile@WriteDate$qqrx20System@UnicodeStringt116System@TDateTime @Inifiles@TCustomIniFile@ReadTime$qqrx20System@UnicodeStringt116System@TDateTime @Inifiles@TCustomIniFile@ReadFloat$qqrx20System@UnicodeStringt1d @Inifiles@TCustomIniFile@ReadDate$qqrx20System@UnicodeStringt116System@TDateTime @Inifiles@TCustomIniFile@ReadBool$qqrx20System@UnicodeStringt1o @Inifiles@TCustomIniFile@WriteInteger$qqrx20System@UnicodeStringt1i @Inifiles@TCustomIniFile@ReadInteger$qqrx20System@UnicodeStringt1i @Inifiles@TCustomIniFile@$bctr$qqrx20System@UnicodeString @Inifiles@TIniFile@ @Inifiles@TMemIniFile@ @$xp$26Inifiles@THashedStringList @Inifiles@THashedStringList@ @Dateutils@HoursBetween$qqrx16System@TDateTimet1 @Dateutils@DateOf$qqrx16System@TDateTime @Syncobjs@initialization$qqrv @Syncobjs@Finalization$qqrv @Syncobjs@TCriticalSection@Leave$qqrv @Syncobjs@TCriticalSection@Enter$qqrv @Syncobjs@TCriticalSection@$bctr$qqrv @Syncobjs@TCriticalSection@

kernel32

GetModuleHandleW WritePrivateProfileStringW WriteFile WaitForSingleObject VirtualQuery UnmapViewOfFile TerminateProcess SystemTimeToFileTime Sleep QueryDosDeviceW OutputDebugStringW OpenProcess MapViewOfFile LocalFree LocalAlloc LoadLibraryW GlobalMemoryStatus GlobalGetAtomNameW GetWindowsDirectoryW GetVersion GetTickCount GetTempPathW GetSystemTime GetSystemInfo GetSystemDirectoryW GetProcessTimes GetProcAddress GetPrivateProfileStringW GetPriorityClass GetModuleHandleW GetModuleFileNameW GetLogicalDriveStringsW GetLastError GetFileSize GetDiskFreeSpaceExW GetCurrentProcess FreeLibrary FileTimeToSystemTime CreateMutexW CreateFileMappingW CreateFileW CopyFileW CloseHandle GetLongPathNameW

madexcept_.bpl

@Madexcept@initialization$qqrv @Madexcept@Finalization$qqrv @Madexcept@UnregisterBugReportPlugin$qqrx20System@UnicodeString @Madexcept@RegisterBugReportPlugin$qqrx20System@UnicodeStringt1pqqrv$20System@UnicodeStringo @Madexcept@Plugins @Madmapfile@initialization$qqrv @Madmapfile@Finalization$qqrv @Madstacktrace@initialization$qqrv @Madstacktrace@Finalization$qqrv @Madlinkdisasm@initialization$qqrv @Madlinkdisasm@Finalization$qqrv @Madlisthardware@initialization$qqrv @Madlisthardware@Finalization$qqrv @Madlistprocesses@initialization$qqrv @Madlistprocesses@Finalization$qqrv @Madlistmodules@initialization$qqrv @Madlistmodules@Finalization$qqrv

user32

PostMessageW GetClipboardFormatNameW FindWindowW

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey OpenProcessToken LookupPrivilegeValueW GetUserNameW DuplicateTokenEx AdjustTokenPrivileges

madbasic_.bpl

@Madstrings@initialization$qqrv @Madstrings@Finalization$qqrv @Madstrings@MsToStr$qqrui @Madstrings@SizeToStr$qqrj @Madstrings@IntToHexEx$qqruiic @Madstrings@IntToStrEx$qqrjic @Madstrings@IntToStrEx$qqruiic @Madstrings@IntToHexEx$qqriic @Madstrings@IntToStrEx$qqriic @Madstrings@FillStr$qqrx20System@UnicodeStringib @Madstrings@FillStr$qqrx27System@%AnsiStringT$us$i0$%ic @Madstrings@PosTextIs1$qqrx20System@UnicodeStringt1 @Madstrings@PosStrIs1$qqrx20System@UnicodeStringt1 @Madstrings@RetDelete$qqrx20System@UnicodeStringuiui @Madtools@initialization$qqrv @Madtools@Finalization$qqrv @Madtools@GetFileVersionStr$qqrx20System@UnicodeString @Madlists@NewPointerList$qqrv

maddisasm_.bpl

@Maddisasm@initialization$qqrv @Maddisasm@Finalization$qqrv

shell32

SHGetSpecialFolderPathW SHGetFolderLocation SHGetPathFromIDListW

vcl120.bpl

@Graphics@initialization$qqrv @Graphics@Finalization$qqrv

Name

.text

Size

43KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

18KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

70KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

5d23b3d30e09e45681c157efaba58063a399f5a66cfe67f58b840583281a9f38

rtl120.bpl

kernel32

madexcept_.bpl

user32

advapi32

madbasic_.bpl

maddisasm_.bpl

shell32

vcl120.bpl

generic