Sample details: 4a068ea32ae51445cef3ac2243e1bda1 --

Hashes
MD5: 4a068ea32ae51445cef3ac2243e1bda1
SHA1: ddfeac999afc4df03e205a25aa5e6639d626fed3
SHA256: e5980fbca7f853b251fff69866363713144ec1fcf95e0a50a209615dee2ab40e
SSDEEP: 6144:3SWT6YfXvxP2SMwFodGQZ0/RNbkBx/MpJWTLiTTwhj4RyEnDmGb3arkA8d:BT6YfXZx9udGQW/R6Bx0pJ2Esj44EDmO
Details
File Type: PE32
Yara Hits
YRP/UPX_v0896_v102_v105_v122_Delphi_stub_additional | YRP/UPX_v0896_v102_v105_v122_Delphi_stub_Laszlo_Markus | YRP/PackerUPX_CompresorGratuito_wwwupxsourceforgenet | YRP/UPX_wwwupxsourceforgenet_additional | YRP/MSLRH_V031_emadicius | YRP/yodas_Protector_v1033_dllocx_Ashkbiz_Danehkar_h | YRP/UPX_v0896_v102_v105_v122_Delphi_stub | YRP/UPX_wwwupxsourceforgenet | YRP/Borland | YRP/UPXv20MarkusLaszloReiser | YRP/UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser | YRP/UPXProtectorv10x2 | YRP/UPX20030XMarkusOberhumerLaszloMolnarJohnReiser | YRP/IsPE32 | YRP/IsWindowsGUI | YRP/IsPacked | YRP/HasOverlay | YRP/domain | YRP/contentis_base64 | YRP/screenshot | YRP/win_registry | YRP/UPX | YRP/suspicious_packer_section |
Sub Files
ebea6d8e907196eaed1299c2f1e204f2
Source
http://elizvanroos.info/home/winchat.exe
Strings
		This program must be run under Win32
Boolean
Integer
ByWl'Word
TObject
rface+
HD@<9999840,g
2w;;thsz
->Vb1*
yHJ%NHJ
J$xtZXtU0u
~KxI[~]
	Vn CG0
SOFTWARE\Borland\Delphi{	
FPUMaskValu
5X0	6s
oXir,v)
w W= Zh
IHZTUWVS
x,(	XO
_-Rf;` 
Hg/stw
8t2S\/
0N|*(}&
V'xpu!h\
j@PVevh
kernel32.dl
l_GetLongPathNameA'
oftware
cales2
?  t.<
!#XGK>8v4#
?y b[j
D^pT.{
&Disabl
FocusDefaultPHotLighk
ive>NoAcc
omboBoxEdit
Window
TOwnND0wSt
|xt''''plhdv!''`\X?
0,($rr2
|tlrrrrhd`prrrrx\XTrrrrPLHDrrrr@<84rrrr0,($rrrr 
|xtrrrrplhdrrrr`\XTrrrrPLHDNNn
BNN0,(
|xrrrrtplhrrrrd`\XrrrrTPLHrrrrD@<8rrrr40,(rrrr$ 
Mageljt
P MSWHEEL
%_ROLL
ORT_(_.SCK
~_LINES/w
jr!/9t
	TFile
	Exception
EOutOfMemorynh
DivByZe
~Range
OvBlow
fv0idOp
TThread
lk8EfHEr?
rEAIt.
0r=<9w9i
\nr@~J
INFNAN
* (()@-
3$-	*-&F&Q{
	$&-[-o
0()(2)Jg
'w~$Prx
40s(=d
twCT?N
GAM/PM
M	ob!N
lwz/L:
r9SU<HtH
@B40-L
kFreeSp(ExA^
{;w$t*a
otAddSub
Xor_Cmp
4FromSt*
TCuNHG4X
Ft?Htb
^KXrH'
Currenc
?Unknow8
J`K	'_Pm
q&A5Pp
	W`rJO
8Aj	o5-wzy
ro@.\r
Alignment
4O	TBiDi
Middle
$w@>LE
sAdapp
'5CQ_m
.TBj|]
V7Pl0X
gGroup
,&Ht1*
$3@DFv
otX[uP
0U)j@_
j7.p-D
0X/7'>
y.>^-I
U`$dr3
F"7Ap&
 C{'4-
BGrCK^
fOQJ^!
V,gYfZk
[7*,(xI
O$Nv0#
O/FX,5
TPropFixup
w+c!`($
gKR>@PS4m
T4YF;w
U&hnMtC
 rq&hP
g%s_%d
1*&i_F
m/_U`?X
AxQhLs/L
(S}81y
4MRXC?
v$dz Wn
0f6ZaQ
o{E]PW
pqr''''stuv''''wxyz''''{|}~''''
`ab''''cdef''''ghij''''klmn''''oPQR''''STUV''''WXYZ''''[\]^''''_@AB''''CDEF''''GHIJ''''KLMN''''O012
cFD2g.
oross&%
>WBthf
edImag
E;@ 10
PXZk)&
LimegY
	FuchsiaAqua>x)
_ppWXk/
/BTgrO
\/Btnu
r3}foBh'
o/=2[	
ANSI_CHARSET
wDEFAULT
SYMBOLc
HIFTJIS
!GJO Ba
GB2312
EASTROPE
3N`7585
DJXV;P
l/I-A-8
,= \R_
wIx3". $$
p(RH^8
2IC^8z
kt$+"(m
p]`d X
J}RjC+
hGSBF<
@$II;E
7([@8k
|B(Vh{
F!Ksi=
?iLw{,
?InitC&mon
/	iSc!wW
^?$t"r
<5XcH*
Z]"u)!
ISPLAY
"GEnum
3Viewe
lZd{40zf-S
L`#$ia
%`&t|'x
A2P	GE>xP
a: t@3
"w@r!C
9@oHxe
 x4lC*
m6uxtheme
	Close!TQx
Xc9t'ugBKm
fHies?gE
IcqIs T
lyTznsp
yO)(a'4Nn
urmn/_dp
On+CPP
&kButt
=D:Cce
#0Qr@c
*]ZRab
GlP.0X
'mdlg_h
HM-t a
IC?.o6
dio'[;
H(p*J>
$D] 2 
I$Visi
)3lCWp
XLPDH<y
y@48,0
TXLPDHy
y<@48,
,DayOfWeek
[Fri+S
^!dAuto,
[(n.i>x
Ur./02
)FP\ss
3r%8s<|!'
f>FFKS9
pp/G32
t<REc]
 2001,
2 Mik2
-ybc'y
okAxE`
+QbV	<
 !"#$%H
y2CTev
9QNm\+
xLx/LrAA
"y	vLength
212\%W
:C4;Ct9
W/}3CG
=g$i;	
t.]Pr="
BUTTON?M
7IE(AL("%s",4),"
,3)" JK13
_WINHEL9
The/-)
d$nu{L
n`0fs1
N	*Jv\
}_0"RF
Wheeli
	9	-`	
l6@GT`
o,4DXO
NyWqDJr
9AIQ^<
$wL{,jEIu>3-
'HSplitV
IkNcAg
fJ+j))
  $$?h
tF-p{>
!6YNiH
,H~DEp
m"9!<<
kW|SF&
xt6AT.R
)C%U}H$mH
/w44\W
IG<H&H
|NT^[W(
w$:BW/g2
Hc[JKT
;v;{Du
SWS?tJ
C^hvg7dy
GP t;+y
DK2S@F
I"F+t 
.ZZZ*-
}J(D:]
n_0r3'
TTx8T1
]^viwh
:T!Q$W
/zI2;5h%
r7=@w0
qOWr%CD@lV
 Wd-Ph
gU(dg}w
g_B8Nm
83p,oa
, vE	c
(0IhwYL/
4@&@H@K
&p5p+*q)DS
Dv$*kE|
PDt1!FW
{u$f2F'F
i3<},;=0
/ t%AR
C<xDfH
4(C{t\
1YaI|e
0$_PXR
$KXrIs<
A*P	/O
\`lukD
$ .fE	
i]_)kJ
qjAo9G
l&29w`!
=tTv(|
@Wqs@=
N !1]	w	R
kB`C!'fI"
#+01z0j
pd4uFy
@o4Hu6
\P?om-
w`Cp)?P
^bO*$M
;0u[-<,
`<rlqA
P	$;CE
BC6CU/)
"S%${B
QROhVcvh
!P{p(d
	M=MximmalCm
fs/7wAn
[Kv n!
h$Ou	O
OwUpdP
`dhlpt
};P8u+~@X>
.5>k>8~
D0KLcX
?+eZF%
qs8VVh
K}$",/j
S,4	ffY
/<PA\Pn0
Rebuil*
rCBXta
TAdxnc}
G,LGOy
kDSeLT
[;>l8Q
D4keysK<
pK$Zdu
Pa!Oii8
1234567890ABC$
GHIJKLMNO
STUVWXYZ
lI=$G`L
?G; S<Y8
xHBAliP)w
]%^S=f
'pL6Ux0
L(WXKX
ZhkIm8f8}7
y5CumA X
~thdAV	
d4z|xcQj
n6ZCpb
1kch"5
QLqOCL
(]YkO&
M>\G=f>
uVmP-?
/:P;^;@C
[u='P*
4FD-#Qlsq
z;PH?X
P_UT})
Ih;J4u
re^h!i
0.	s8P
C /o@.(
{N0FDO+\
1PixTsPi
H_=0YT
):&qL+
!kX%t`
_#lN{b
9d88D9
r-[L"x
qYV~W!
mO32Dh
o( EC'
%-Am5V
`^Jp d
I[Lrlpe
=X,/'P[
ll t*"
ld3u`/
x/ p_1!Ta
?79.:AH
~,`tm`
t;Cpu'
,kHLcp
<AvTf8
xhY0BHI>
}%b%-y^
t#;ADti
`Ao-t1
y]O%f($
5p@7"}-
P''''L04|
LL6PP}VS
@ADdpp
fbH\n	
v!SOo4&
thtg+X
MAINICr
3VhX6EC3
G[t4aM
YS=s%!
_7\[%!
 ;,60Is
r!hP-Z
^<s'DK{`
;sHum|
LD$\id
fP5e$tD`
;i W3sHG
Lwm89&td
|5?be.
T|DZ<@
_xR9x7
YV<(Z?Z
tKpL:8#CA
ReaUE'
g[fL]1
J.Khhn
d.eG<3&
PKRr&T
Y1Tb#-
.vXvtrd
JRL"~U
Ni<-*}
:e",rs
B; -$${z
@MeV"h
!@Fpk>
),>)I:\
4ai7Bq
jhjm6$;j
OHO89C"
S&$pqa3v7
mMW88@K
gh$u<O
uOFPN$3b
uhHfu8voyEeFP?EvR0MNuTJZ
7 ;nx"
)P>"!n
at 0>0
<DLT\d<
Li[gej'#
&-TPF0
<$4HT`
;Mz^TF
y<Vp/&0
F(v\OxO{
H~PwFD
/?N_nVP
.7&@^,
Te7.,8
'4""C['B^{
:L*y8Z?yv]{
J"Q[Q&B"g
Q& :"Q
L3'L3'L'Lb
2C`"(8
+=7,w_
^oQRte
m1p~=r
rppB;U
5,6ydBtH=N
=Lun.O
o/QDh9
-Q310&f
7pP%4]
hVRTW.
~/Pa8t
B0|L:R+v`
$0CbYE*Oc
:t	w6&
hG&FX=
oPsAP>
?QR$1ww
"gkvWo?K
qt=!4r
gR/po0
4j]<.&
|3a9/<V
uvo\h|d{
No&6@N
\jS[6	o
BN>Mp*b
M;(<oZ
mWs#xS
Ta_,zm
k`n,0"g"
	$[H,l
cBhV0.
O>CE:{u
FSizbJw
iD,0#'
g\?xYK
SZ 4d\
jm,-T*
N{df'<
A>\pu)
}uf8>@7
@(-6$%
6bva0-
oU,}'6
WW#4xf
F0Zv"<
1(>*bC
^Y;Ii7
aLCD+/a
~8WO>K
!9lt	?
&0	X-<s
k\wo ?
3?*yfB
6"\Q#T
Ao<qc.
$w<PQb
K72oHS
?:"xB{
To3{jH;
3;q!,e
n?=uy;
P_GVRDi
hxAW="
m*hmi3
}{y%,`
((@d}5h
R^<Zz!}
X*-\}b+
iN6yA1r
oN7y@H4
{i=Hj@-
D\t	EZ
@!o(rT
TXO"n/
@6y@tE
K.188p
/Bja%"
6<H0i0
Z 7{FQ
:AR9Q{y
5/rT~vDd
9fc%Vrt
"gY$uU
)Z+!["W
\og%pl=S
($+*k|
)	\DS|
1+VO+B
<O<Q&+
<.3xLr@\
oh%Exi
yQx\|!
<sn^I$`
0GNok1
@nNv*P
n/D3o=
@~Aai<
2?oI1@
yMKN+`
G(VDc7D
62o`{[
iS+eE>
5sa0t,
,u<	aE
Lc-WL$
.P'&P9)
_J1_u3
?;Z9{s
95)K3j
zo=p)H
 P0$u{k
t>d$26
	Z`%Oj
,E-m6#
u:%3 <
2/B"D,
2O(|{o
`<Dxu5
Snlx2!ItD	
)tg\WiP
,&?nSS
*QJa|[
UNTlJk!-
Ny^JGl
F,<nV 
]6/[_Hj*
g]rwZn
4.,FLxr
E!O) ]
S'w%I>
vymnbX
9i]v@`
;Q	y(|
yVU"5}
h2s~1tY
7u$R[5f	
ebkwi@Ly
?FnokE
M>;V17A
p:[VF	q>e
xdhVCz
0.w;>-
}_'"d,
&j4,3v@
*oJX8d8
/J,/oq
qPwupSb
nvv@5w*
 b,HL2	
"=y0c~
lLe'9J
0a)8;u
5yRj?MR
3Y	7)a
*2GA`|
!+ve]~
z%cz(p
sVnZj8
c!)}VsA
=H!xao
Ct6g6D
<,;1ET
0ZS~_9
tl?X%D
GAm[|DF
_\nebC
g/u|Pg
@Ez{dI
L1dP9j
;sh+J0p
FR5gN`
;< 2B0
a2p~TjZ
4*@KQz
`r=!|NOs
$M?kpS|iU
!bjw3p0
nO%&0b
	{bN@K
iE<l1_
#S1CpX
PXC Q2:a
N0#d7K
 S.S}r
3:`(NI<
Bl\/@]_
>eS\`FP
VK5uxl
_h<\Z>)
'Y$9# 
#+"a?O$
%o:;hi
^2:R^&d.7
}AS@eTL
#8`D*t
F?$8s,4
-FH6O(>6
@5,qen
L&zr'8
G`B>JL2$
r4F ^k
	(c?!@H
x-LNp-/
:v}<G6
xs3fTS*
8 p?Nk
0wK8?gP
VB[m?'H
)s `V>
:~azw)x
ZQ`,<_
C>n=	o
RGFQ7|$
"lJ%a}Q
jDc+x5 
No*USJM
?4HeYA}a
?YbJZR
lc:Ihj
f`'</`
jm\xNU
GF6Jmn
#*Fikdgo
NCFp2i
nW	?gb
jCGm!X
.mTt_G
!W/v7i
C3l;Fo)
kEXU8(7
'#dWig
}ipbrd(Y
API*& 
IDlgR3
Virtual`
OLibrar
Ad]LV3<
Id'cZ)
NzFTo3Byt
/%B.naj
ZZchBl
p%F$!s
pK[32A
F^`R'6L
*'(8H,{Q;
X7D<To
ubUajB
GGGVpI
a(	o85
#Ed?7R
,`DATS@
XPTPSW
rrr;lllb
L##H)((Sw
ddsJSS
lll4qqqs
EEE%```k
--3#???
33:(???
XXX'|||q
???	kkk=
AAs"--;
KERNEL32.DLL
advapi32.dll
comctl32.dll
comdlg32.dll
gdi32.dll
oleaut32.dll
user32.dll
version.dll
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
RegCloseKey
ImageList_Add
GetOpenFileNameA
SaveDC
VariantCopy
VerQueryValueA