Sample details: 83494c1f44fa28e32c0675689f4570a1 --

Hashes
MD5: 83494c1f44fa28e32c0675689f4570a1
SHA1: 92a5ec89f38e8368645b07eececf41b995d4a39b
SHA256: 84c693ca2cbe630163ba2f3b7d89a861c3cba3a7b22732c2580f0e5e387281e7
SSDEEP: 12288:g0eUEpcV2dt8672s1hdrikd63itFtpu2DIr:g0ejQ2dt52srpiZ3YFtLUr
Details
File Type: PE32
Yara Hits
YRP/PackerUPX_CompresorGratuito_wwwupxsourceforgenet | YRP/UPX_wwwupxsourceforgenet_additional | YRP/yodas_Protector_v1033_dllocx_Ashkbiz_Danehkar_h | YRP/Netopsystems_FEAD_Optimizer_1 | YRP/UPX_290_LZMA | YRP/UPX_290_LZMA_Markus_Oberhumer_Laszlo_Molnar_John_Reiser | YRP/UPX_290_LZMA_additional | YRP/UPX_wwwupxsourceforgenet | YRP/Borland | YRP/UPXv20MarkusLaszloReiser | YRP/UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser | YRP/UPX20030XMarkusOberhumerLaszloMolnarJohnReiser | YRP/UPX290LZMAMarkusOberhumerLaszloMolnarJohnReiser | YRP/upx_3 | YRP/IsPE32 | YRP/IsWindowsGUI | YRP/HasOverlay | YRP/domain | YRP/contentis_base64 | YRP/screenshot | YRP/UPX | YRP/suspicious_packer_section |
Sub Files
4df2a9c148268bb8c7d3618ec956f35e
Source
http://unitedtranslations.com.au/jn/sgfsfxjg.exe
Strings
		This program must be run under Win32
Boolean
Integer
ByWl'Word
TObject
rfaceK
On''D@
Y;vBjCX
bZYYd,h
F5G\'~
 A(9l*
h02JjdP"4[]
"w)f%+L2S
HJ%NHJ
^{Hb`-
Axt$(0
\xtZXtU0u
	N"	w%9
~KxI[)
SOFTWARE\Borland\Delphi\RTL
askValue
ZTUWVS
6ytqQo5
^_[G[(
@>p6V^
_-Rf;` 
Rw3lo+	
0N|*(}&
\.pL.e
y>Q\vX;A
pMF0d9lK
E$t(;(
<>x@ F%
DHkernel32.dll
etLongPathNameA'
Software
cales27
Yt%k;s
?  t.<
4]lg&8
kh~E k pOX
&Disabl
FocusDefauw
ltPHotLigh
oxEdit
Windows
ND0wStaJ
|x''''tplh''''d`\X''''TPLH''''D@<8''''40,(''''$ 
d`\X999
|Magel
 MSWHEEL
%_ROLL
ORT_(_
.SCK_LINES/
)zt0z.
d@hx'N:
	Exception@~
EAbort
wEHeap
EOutOfMemj
EDivByZero
~Range+
Inverflow
fv0idOp
Safecal
|$TMulRS
l9R|+@
 _43pB<
-_<.*F
0r=<9w9i
INFNAN
qh~<@t
@-3$-	*-&*$Q
	$&-[-o
0()(2:
	g0nh?
8^d#7%|
P04~05
<P#cRd
SU<HtH
\N~3t7
Yaw ~I
9j*!%-
 d, Gn2ms
hGhhO 
0%[h`@$
kFreeSp
otAddSub
/MulDivIdivo
Cmp4FromSt*
0!C8D(
a0NHG;
Dispatch
Ft?Htb
DH,	8J;
CCs E	6
~LXQ,9ojB
)9yeLoB
H19ja!
&B]{,B&
>8!8xU^%
dK9u4\DH
/Empty
knowDeci
Na,'s?
cX*/x9
S$WfFF
QfA@"]
TAlignment
nLeftJ
wO	TBiDi
(gbdTo
g6Shib
n}CutyC
~@nwPnS1j
"qg	yE
0vI>mU0
YsAdap
3<0^(s
TBjicA
)(Pl0{
NIdfM"
2gGroupu
Tn|nYN
<XCL(;
7cC?[5{D
|U?#\f
_#Sb2eVxS	
&GTH2C
H/mB^[ky
jX10 W
Cagnil
t>gPh|`W
A{h<W1
%s[%d]
\VY/&B
hZ&A t
n|7Gd24
-TAXJ{
j@ (sAk
~"V|I 
],<%trT
t_C_BG
@o]TjZ
TPropFixup
7q7EKu
	6[H(EN
/rlmT7
Zk)c,t
l>-NvX
XAsm~0
B@~(,BO
S]8I.F
NpI:R!
pZ;y`cO
CF)<M[
)tQ4/'
fzHghKT'
Sda8M%
0-tb	_1
$t9bY8jL
 $b,Mr
57?R b7
-`E]Pgth
Wvd.BT}
\%yk.B
NNNNpqrsNNNNtuvwNNNNxyz{NNNN|}~
NNNN`abcNNNNdefgNNNNhijkNNNNlmnoNNNNPQRSNNNNTUVWNNNNXYZ[NNNN\]^_NNNN@ABCNNNNDEFGNNNNHIJKNNNNLMNONNNN0123NNNN4567NNNN89:;NNNN<=>?NNNN !"#NNNN$%&'NNNN()*+
FontPitch
o 0	fp
.FDiag
]oross&%
He*d3aL
gresT0
AN|Runn
PDc`D{
fRxwNow
?T@jx.6
MuE;@ 
_~El{c
4o7E]G
!7clMaroonG
PurpleG`
Silver
Yellow
uchsiaAqua
^Ca'_c
/BtnFU
uG3DDk
ANSI_CHARSET
5wDEFAULT5
?SYMBOLc_MAC
HIFTJIS
GB2312
CNE"BIG5
C/BALT
RUSSIAN
ASTROPE
B?;D,h$]
`,Efu@
	?4VdV;P
TC>G$r
G xH?	 
c3^Q`?
MFy	#^
IWmaLk
f{R;>U
Ix3"^ jC
X	l|/V
&L"@c`
%5p@9.o
c]XX0MD
DPRN~n
&9tuiB
)zB0B>BFzB1
X{G|FM
R#YW3D
>jtC(yoC
*&#jI~!a
am@1^OpC
?"	a"5
A(K?tM
GX"hM>
.TU-7tZc7
M6_gh?
)Lk[[U
00a(JC
%Ov0&&F
_~8yj3a
B"/W"q
0~&0M@Mt3
InitC&mon
GsEx,f
rrrrD@<8*
rr40RP
>,(999
'crA0-O)_*
-Mhnb,
''qPD0
.ISPLAY
3Viewe
ur$87X
YGgJ+Fk
Device
WW]p1&
u9x*;W
rL8wLh
W/ShbE
{;Xc{ 
uxthemep
Close!
yO4NnSX{
VR*na"
qw>%dV
  2001,
Olbsfv
ShVauo7W
C	TtH;
;HKh`D]`
`DEhB~
>=,-qM
bB!0Dv
"Visivph
#BOn][
$C,bx^
,sP`pV
Ur()*rA
\py01&v
DP{CHv
Ats<tC
hxD\x_
y	MaxLen
\%67%S
L'(\%S
oheckl
\$C,-C
L%34a 
'&u6PH
.<Elx4
uIZO]!3
F%6D6J
7A'8,R
foM|./
BLU,@HP%
j_ks=p
t?\[yDA
BUTTON
d@.`H`
d@yd@w9
h~tr@&9-
|B0h4o
^Kz@,B
{=H9lM
]H9{).
0d(\ Ty
	DWywygzL
	=.}.o
(F<^OR	
`}HaSj4K
02M6W&
_Ign@e
`4 oA	
Fi&$4^
tr%.8X
<AIQYa
15Xzn?
'`@kt:H^
NE(AL("%s",4),"
,3)" JK1}
_WINHELP
	9TGL%
(x8%Ex6
p7L&DM
dmManu
L4OD;D4
Target
ock _4
gWheeli
p|A<f}
/yDocky
pLX?$:q"
'PRD7?(G,
3BtZtW
'SXO09$_WSEWE
'HSplit
  $$?h
uz"Ys@
+PTmY(S
AF[}t:
0?E(z+R
lIZt7[
XLu7;Wx`*mh
o$;~|u
?9q328
u..LhD
;@H/ple
rr++KX!
i':_Wt+
$.ZZZTZ
>0q%^e
[@C,H0
L!WJLH
'y2;,%
~"15	y
pVWd+!L
$vyw70
Z2* Vi
L~/KOp
3 Wd-?
`WjEd>
yn|$44$
Bk6^,(
:H@HF0
+PL)DS
HP;t@~
/eECZn
U8G<KO"6
V-<#a8{~,
\<I<m`~0
!pKc:c
1B\Z.o
Ja!}9(W
0"J!_?
m1PxLtg+`t%
P!>@a`l.
HL&pcty
PWB&Q'
'?D;`F
bpKz3ju%
![<xD 
9UBua#
K''wAD
lgWSrA 
kd8xN<
&j73tRQ
RHM8utb
EL$ .	
x8TD+B
!]LzK0
C1H`+}
>Z,VxO
BduQib
$'TX@w
2^iO)>
`=m"0/
hEFH%@
<1A&Lu
Pl\J;#
e$FP_{
<Owp\B)
P"m$#P2
e*UC/ _
KpS$K]
u!P{4(
80<Hr!
KZw(NLSKIM^i
%L'G$[[
{W,<Ekj
EF	ETe
0 [*Gh
o?RTP&
itR{\N
 Y!vo5
eZ=o%_m}
Z66W'`
	]|@k!
|.m#M2R9;
&;GFO2BHL
S,4N0SP
yCj5X4
2r hp7
(E9J7|B
)8`08]
TAdxncP
sFt'k:
TA~G7 !
Track	4mg
4567890ABC
FGHIJKLMNO	
STUVWXYZRei
,%\'G{{
FAO`-K
~@!%]|5
YXp>E 
jI|WE`
.5H2LM
B7^X`fXU1L
X_HlX!
	mJPdJd
o&at'e
tD	CoZ"
`}F9f(
u"IP]H0
P[GB.I
<38`*R
uH/HA.
HuHxB{
HIh;J4u
v(*}/,<E
4V$?)!
!)QdMi5
&uOS6J
egul6:
U|$Smodh
BThumb
ps1PixTsPf[
C!FI8R
uif+LW
 G2T00
oF$pHn.
)97Fl9
Ky(daQ
@nAaam
^lHz;~
	l tFh
b#(S&u
h)m` F
=ibT4'
IO<S fy%!
}J_'eL
t;Cpu'
*-ZUC/I
ap[Y:T
+^r@x()
E%0@6L
uu0rf@+
t#;ADti
HP!)t%
+Uh,/E
?<+XH^
XLm44I,
>"FhN"V`
/F`D'f&
?m&FXI
04|X~I
_L@Lrm
SL;t~'v
$xg~FR
@'MAINIC
1gu'%5
V8	.cP
jI4Uct!
ltest3*+,u
't<j@jsD
j!4P-Z
P'L6Q:
.GXi20
h^<K'I
ImvFL?d>
=NPy"}
,~,F' 
o;^`u0
%p*|]8
]5!MMS
*mCf)~
DHRser
Vbar5d?
NOGLOSE
ABORTRETRYIGB
b%O-Ie
Fs ?x!
PG! 8i"
-|*V4m
F\fQhA
`T.rKZ)C
6c4qv	3
|4+ICN
usPan;`
4c)]:%
izeGri
sIdW&p
r($6?	Tu
TRich0
NHtRG!B
*DlP\P
uf0${ 
J2K!2p
g8Qa! G
%}u50[
noboxLw
X%.#~uD!
]:		KD
Oc!Bp!O
BY\Ogw
@)" GO
 *,pIh
M*Z<s#$
0am+%P1
#*D<U`C
LGCnKg.#/ w0
RICHED
k-hyKS
+G8"X<w
<`l)61
C#9X`>nm
_M_7h^
TX[.c7
_@5S<m
B;5F	mW
-I#maF
 x7l/?U
BD+[O&E
[XVLp+
@*P!ZK
zu'uv.
VCq%U:j
m	TKKW
`al" @;
SR^,pV u7
b5HL(=t
GQ/cCkg
2p1qub
]Wi	_D
.	-@(H
i\	B6}
P!P0-a
E+tPx-
,@fPJ,?OJ+H
dPLvKS
3m}#p0R
eF?|Wea@mR
Ot\r"!(\N+
AUSESTO
P/NEXTREV
BACK,COR?
&.NdGs
%3unxs)	
8"e$R2
r%W2F2
	TJPEGb
Nljpeg$
edX6m&
A7/vy0
'i;`(c
n77B=E
?F@D2HU&
iTLPTX5
u.-;Sts:L~
\5AD'^Z
HKB2KBC	
QZq f|
8H[qg<PPA@
5j@0>H
Kp8./H
\x3Py*
d4ShKl
u'A7*~_
t#mng	
}1#(Z@
{b4w	[D
P`j&r6
3p:Z)#
]r$#K2<
;@S`YOq
Px.04@
2sJ8m8
+\41Lru
4CvtQJ
 #,dv	&
G	MGv`w)
`,E|;xx
*Hap P>
9&A`>,
JFH*CZ
hdMc?!-E
Q<xpd.
QTQa<t
(YYm= 
,T;s$|
A7T]O@6
\HE<Enm^\
VHg1%z
qu;&@q!L/
<'``c82
NM]@lN
sLR#t*
\H0=@/O
l	:T@o
4TB+%{
<0l@eP
P*`#IM
H +4#U
LxM86.NR`
D*0_`$
:ou>;!
n3mbB&
={_8[w
W *hBQ
&`/`ou
-bR75V
Hag'$d
Q=DY">
>51KhL"_
bF87Ze
q-C(?W
wRf +Q
tRr$Ctt
lVzz3Mki
;7#;+}n
G8(UL6h
OOE\h 
~TzTvQLI
A|Yu$Ci
sp@v}5e
<uV? L
6iP`K8
Y>4`t"
2SSD@P
		i+9@	-Yl\
Kpc".	
v	vwgl
YjHFl 
<BRF.h
)8ir` 
DdH.H~Z
V`W(( 
;mJHJQ
T__2687542845
6466913
534532
792226
<021$wU(
15833,'82440`
5<O812
@Pw'(35TO
7862As
+5.8AE
.17a2d
 Oo-.I 4.I"
 mJX'b0OW-
5!UpY{
5(Z%@~
'94176
901!Mj
h34&\=
Gr@&y9>P@>9!/CP
>@DHsd
,G3Z20
/9089 
b'4693(6
"4'367
zH'f2L.-y
r22Tol
{'95xh'E
abcdefghijklv
mnopqrstuvwxyz+
=l"gT:
\Run3&
DVCLAL
OW64*.
hXl(4z
%.*d$|,
yDLT\d
&@w'H[[
?%V'&(
.08@L$
4<@PXy
#*189y
3:;4-&y
kO:'7/
@.Qhq\y
eH_bpv
%&'()*
VN2lw^w
7>36O27
/?N_n'
Tu&@p7
f{aV`1 
Ifvrl^d
7ov Gq
	?g{ ELM
p~ci'.tA
i2mo.y*A
f:nl	;
cCSojaZ
Gj>b\`
 Ux0m+tBh;8
#{O&GZ8
D3'EZ0\f
C3lTSm
3.P^ko
@G\MEWN
'lC%:qE
eg/|W\
H!pz>C:
b/z_o>R
5^!8ddesB
lmmmUO1#
VerdHQ
c'Li5KkMA*
|k>Q1`
%lb*A	
.hkdR.
. V1.(
#(3+#&0&
:9"+?C>8C
5j:SM5
TlH\0Y21
Trp0d^
LA2cp<
'/'k~	?
B&fg`v40;
DuckyK
//33//@
#0+.'.+5
0!fu}jt
t17m+&
A"& #$4m
aOE@28
dJpo2e`T
rE/SnU
"i5;/Qr
VPX!l~
@!1A0Q
6\veVKrlv
mb/mUF
&j5o#>UC
 &Jb!ZD
==}}=u
FYDc98
kest@r
_PC(X_
TlsJt!
*Modul2
dtrcpyA
bOEfOf
FzlPath
%2Q0lhw
Pe@w;2#eE
C@M)#c
ICA3Hf
U*u*'L
#[H6|A&=
J-%m<R
0%s 7A
 `DATAu
L@t:W7r%
XPTPSW
DDDDDO
DDDDDD
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffh
fffffffffffh
ffffffffff
fffffff
fffffff
fffffff
fffffff
ffffff
ffffff
ffffff
ffffff
ffffff
ffffff
ffffff
ffffff
ffffff
ffffff
ffffff
fffffffh
fffffffffffffh
fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
vffoff
ffffoff
ffffoff
foffoff
foffoff
%1;DDDDD
$1;BDDDDDDDDDD
+DDDDDDDDDDDDDDDDD
1DDDDDDDDDDDDDDDDD
8DDDDDDD8
1DDDDDDDDDDDDDDDDD
$,,,,,1D8
1DDDDDDDDDDDDDDDDD
1DDDDDDDDDDDDDDDDD
.666668D8
1DDDDDDDDDDDDDDDDD
4======D8
1DDDDDD@BDDDDDDDDD
1DDDDD6
DDDDDDDDD
$$$$$+D8
1DDDDD6
DDDDDDDDD
8DDDDDDD8
1DDDDD5
DDDDDDDDD
1DDDDD6
*BDDDDDD
1DDDDD5
DDDDDD
6DDDDDDD8
1DDDDD6
*DDDDD
1DDDDD5
1DDDDD6
1DDDDD5
&DDDDD
1DDDDD6
BDDDDD
1DDDDDB6626DDDDDDD
&1....2D8
1DDDDDDDDDDDDDDDDD
8DDDDDDD8
1DDDDDDDDDDDDDDDDD
1DDDDDDDDDDDDDDDDD
1DDDDDDDDDDDDDDDDD
4DDDD1
1DDDDDDDDDDDDDDDDD
(DDDDDD1
1DDDDDDDDDDDDDDDDD
1122222
".8DDDDDDDDDDDDD
$1;DDDDDDD
CIDATx
gk~617+
KH}8XK]
._[(_g
>	}^	u
KERNEL32.DLL
advapi32.dll
comctl32.dll
comdlg32.dll
gdi32.dll
ole32.dll
oleaut32.dll
shell32.dll
user32.dll
version.dll
winmm.dll
winspool.drv
LoadLibraryA
GetProcAddress
VirtualProtect
ExitProcess
RegFlushKey
ImageList_Add
ChooseFontA
SaveDC
CoInitialize
VariantCopy
SHGetSpecialFolderPathA
VerQueryValueA
mciSendCommandA
OpenPrinterA
&$%@*347629139&$%@*
&$%@*&$%@*1&$%@*&$%@*&$%@*U
lE~GlE
]~u;0_
GlE>elE
lE@MlE
elELAlE
lE*GlE
MlE.olE
lE0ulE
lE2elE
lE4ilE
lE6elE
lE8alE
mlE:elE
lE&ilE
&$%@*&$%@*U
klEJelE