Sample details: 17778ecbf0e9e4b6961d4deb79ec1b78 --

Hashes
MD5: 17778ecbf0e9e4b6961d4deb79ec1b78
SHA1: 3ee0f243d300e91f1b91c658f9f9de60fbed1cf9
SHA256: ca1681179b048336fa4315d4c5952a4210fcb5d8927a5c504336922372f51b00
SSDEEP: 192:IuHY7r46kkcKSkotUwS8AZOMXru9I09/+gucSPYGp4E4huU:I+er46kk9Sko65fiy09GguxYm8h
Details
File Type: PE32
Yara Hits
YRP/Microsoft_Visual_Cpp_v50v60_MFC | YRP/Borland_Delphi_30_additional | YRP/Borland_Delphi_30_ | YRP/Borland_Delphi_v40_v50 | YRP/Borland_Delphi_v30 | YRP/Borland_Delphi_DLL | YRP/IsPE32 | YRP/IsWindowsGUI | YRP/IsBeyondImageSize | YRP/HasRichSignature | YRP/domain | YRP/contentis_base64 | FlorianRoth/DragonFly_APT_Sep17_3 |
Source
http://185.70.186.150/sploit/xp86.exe
Strings
		!This program cannot be run in DOS mode.
`.rdata
@.rsrc
@.reloc
jAXjpf
jhXjtf
Xj/_j5f
Xj1Yj.Zj4f
Xj6^j8f
ZjfXjif
Xje[jsf
j\Xjgf
XjrYjpf
Xji^jcZj_f
Vj5Xj1Zj.Yj4f
ZjfXjiYja[je_js^jmf
YjrXjxf
sDVSQQh
j\Xjgf
XjaZjpYjh^ji[jc_j_f
SVWjMXjoZjzf
Xjl[jaf
Xj _j(f
XjWYjif
j XjOf
_j XjAf
[jbXjKf
YjiXjtf
j,Xj Zjlf
XjkYjGf
_jCXjhf
YjmXj/f
jfXjif
kernel32
VirtualAlloc
OpenProcess
ExitProcess
WriteFile
FindClose
CloseHandle
GetSystemInfo
lstrcpyW
lstrcatW
lstrlenW
LoadLibraryW
GetModuleFileNameW
GetModuleHandleW
CreateProcessW
GetEnvironmentVariableW
GetSystemDirectoryW
GetTempPathW
GetWindowsDirectoryW
GetCurrentDirectoryW
CreateFileW
DeleteFileW
FindFirstFileW
GetModuleFileNameExW
GetProcAddress
LoadLibraryA
GetModuleHandleA
VirtualFree
GetLastError
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
KERNEL32.dll
wsprintfW
USER32.dll
SHGetFolderPathW
ShellExecuteW
SHELL32.dll
InternetOpenW
InternetOpenUrlW
InternetReadFile
InternetCloseHandle
WININET.dll
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel level='asInvoker' uiAccess='false' />
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>
0#010N0h0
383H3s3
5g7k7o7s7w7{7
:I;U;^;i;p;x;
<(=:=W=
4+4Y4`4h4