MalShare

SHA256 Hash	File type	Added	Source	Yara Hits
ebf0714be6323b17e7e340e9f98cd3e9386d537aa555d1e7d654d6c6095bf1bf	PE32	2022-03-08 02:00:12	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/borland_delphi YRP/with_images YRP/with_urls YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/System_Tools YRP/Antivirus YRP/VM_Generic_Detection YRP/Dropper_Strings YRP/anti_dbg YRP/antisb_threatExpert YRP/network_udp_sock YRP/network_tcp_listen YRP/network_smtp_raw YRP/network_http YRP/network_tcp_socket YRP/network_dns YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/win_hook YRP/Big_Numbers0 YRP/CRC32_poly_Constant YRP/CRC32_table YRP/BLOWFISH_Constants YRP/FGint_FindPrimeGoodCurveAndPoint YRP/BASE64_table YRP/Delphi_FormShow YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API
0cc55a7c97ee3373573567d8952abbbcc9320c69fe7c855c2b0cad2219384749	PE32	2022-02-24 02:28:49	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/borland_delphi YRP/domain YRP/IP YRP/contentis_base64 YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Delphi_FormShow YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Delphi_StrToInt
5c87137ddbc109f78de3cb9db02207cf233d1d3740359c7d918481b687a99651	PE32	2022-02-19 09:48:24	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/borland_delphi YRP/domain YRP/IP YRP/contentis_base64 YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/Delphi_FormShow YRP/UPX YRP/suspicious_packer_section
6d8e1c6ec61f39b39e79f4e51df7c93e6a000b30ccefbf12dde4118acb439fe4	PE32	2022-02-18 12:37:29	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/borland_delphi YRP/borland_delphi_dll YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/Browsers YRP/Dropper_Strings YRP/Obfuscated_Strings YRP/Check_OutputDebugStringA_iat YRP/anti_dbg YRP/hijack_network YRP/create_service YRP/network_udp_sock YRP/network_tcp_listen YRP/network_tcp_socket YRP/network_dns YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/sniff_audio YRP/spreading_share YRP/rat_webcam YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/win_hook YRP/Big_Numbers1 YRP/Big_Numbers3 YRP/CRC32_poly_Constant YRP/CRC32_table YRP/Delphi_Random YRP/Delphi_FormShow YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Delphi_DecodeDate YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API YRP/FVEY_ShadowBrokers_Jan17_Screen_Strings
a024f9f7a2a2884ba82399e2b20d5a2af6130e4073c7824247be914367c09a8c	PE32	2022-02-18 05:04:33	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/borland_delphi YRP/domain YRP/IP YRP/contentis_base64 YRP/antivm_vmware YRP/network_tcp_socket YRP/network_dns YRP/screenshot YRP/keylogger YRP/sniff_audio YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/Delphi_Random YRP/Delphi_FormShow YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Str_Win32_Winsock2_Library
c9a7a9e514ecd20f6ef30a2e1ac886dd5644aa69c2be81f7a029fa385debde96	PE32	2022-02-18 03:08:17	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/IsPE32 YRP/IsWindowsGUI [+] YRP/IsPacked YRP/borland_delphi YRP/domain YRP/contentis_base64 YRP/Obfuscated_Strings YRP/win_files_operation YRP/Delphi_Random YRP/Delphi_CompareCall YRP/Delphi_Copy
7dcfc9035623632252a62d4a861fdda64903eb5e57121473520e86a0ba3b842d	PE32	2022-02-18 00:40:47	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/borland_delphi YRP/domain YRP/contentis_base64 YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/Delphi_Copy YRP/suspicious_packer_section
2a969958a0d7c5a095c899c98debd189a6229f339f48c498143d9c64966f59aa	PE32	2022-02-18 00:33:56	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/IsPE32 YRP/IsWindowsGUI [+] YRP/borland_delphi YRP/domain YRP/contentis_base64 YRP/DebuggerCheck__QueryInfo YRP/ThreadControl__Context YRP/Check_OutputDebugStringA_iat YRP/anti_dbg YRP/inject_thread YRP/create_service YRP/escalate_priv YRP/win_mutex YRP/win_token YRP/win_files_operation YRP/Delphi_Random YRP/Delphi_CompareCall YRP/Delphi_Copy FlorianRoth/DragonFly_APT_Sep17_3
d69bd14ac270042d1bd6b634340d18ddfc29d2e8359baf91cd6cd652225f4c43	PE32	2022-02-18 00:23:05	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/borland_delphi YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/maldoc_OLE_file_magic_number YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/Big_Numbers0 YRP/Big_Numbers1 YRP/Big_Numbers3 YRP/Big_Numbers4 YRP/Delphi_Copy
34f022752a72acc28f2031ec1e710109a9e5e3af6c09bb8b9cdcf8fcef6dddbf	PE32	2022-02-18 00:10:43	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/borland_delphi YRP/borland_delphi_dll YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/Browsers YRP/Dropper_Strings YRP/Obfuscated_Strings YRP/Check_OutputDebugStringA_iat YRP/anti_dbg YRP/create_service YRP/network_udp_sock YRP/network_tcp_listen YRP/network_tcp_socket YRP/network_dns YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/sniff_audio YRP/spreading_share YRP/rat_webcam YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/win_hook YRP/Big_Numbers1 YRP/Big_Numbers3 YRP/CRC32_poly_Constant YRP/CRC32_table YRP/Delphi_Random YRP/Delphi_FormShow YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Delphi_DecodeDate YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API YRP/FVEY_ShadowBrokers_Jan17_Screen_Strings
908200fe8cf7ca04a139f44b9a50e5d427164796e87cff664167a80395e1163b	PE32	2022-02-17 23:42:22	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/borland_delphi YRP/domain YRP/contentis_base64 YRP/Obfuscated_Strings YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/Delphi_CompareCall YRP/Delphi_Copy
e33eec1f19750dcf35dd841a430bbe3f012ffcc2b651690732fb9d4e73141925	PE32	2022-02-17 23:42:06	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsBeyondImageSize YRP/domain YRP/contentis_base64 YRP/Browsers YRP/Dropper_Strings YRP/Delphi_CompareCall YRP/Delphi_Copy
f80c5b29676bc588553e6a19a3c648124c15f81bb6e79174243b8177e9398d68	PE32	2022-02-17 21:54:14	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/UPXv20MarkusLaszloReiser [+] YRP/UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser YRP/UPX20030XMarkusOberhumerLaszloMolnarJohnReiser YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/borland_delphi YRP/domain YRP/IP YRP/contentis_base64 YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/UPX YRP/suspicious_packer_section
f3afffb095d747a265a5b7d5c3600c46fdf00415068f605ce3ef5deb777e97d9	PE32	2022-02-17 19:33:51	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/borland_delphi YRP/domain YRP/contentis_base64 YRP/Dropper_Strings YRP/network_tcp_listen YRP/network_tcp_socket YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_token YRP/win_files_operation YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Str_Win32_Winsock2_Library
7721f02ef47fd423a3f5fae12af8f3cbe7d59adc774f8b3dbd8b57b4c96f95ba	PE32	2022-02-17 18:04:55	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/IsPE32 YRP/IsWindowsGUI [+] YRP/borland_delphi YRP/domain YRP/contentis_base64 YRP/DebuggerCheck__QueryInfo YRP/ThreadControl__Context YRP/Check_OutputDebugStringA_iat YRP/anti_dbg YRP/inject_thread YRP/create_service YRP/escalate_priv YRP/win_mutex YRP/win_token YRP/win_files_operation YRP/Delphi_Random YRP/Delphi_CompareCall YRP/Delphi_Copy FlorianRoth/DragonFly_APT_Sep17_3
9ac09aacf136aecc621a8345d80e04e8ced59c1e48714f2aa10d31f3a76c6b40	PE32	2022-02-17 17:43:59	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/borland_delphi YRP/borland_delphi_dll YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/Browsers YRP/Dropper_Strings YRP/Obfuscated_Strings YRP/Check_OutputDebugStringA_iat YRP/anti_dbg YRP/hijack_network YRP/create_service YRP/network_udp_sock YRP/network_tcp_listen YRP/network_tcp_socket YRP/network_dns YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/sniff_audio YRP/spreading_share YRP/rat_webcam YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/win_hook YRP/Big_Numbers1 YRP/Big_Numbers3 YRP/CRC32_poly_Constant YRP/CRC32_table YRP/Delphi_Random YRP/Delphi_FormShow YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Delphi_DecodeDate YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API YRP/FVEY_ShadowBrokers_Jan17_Screen_Strings
6ee8b19e9da34597b336bac4f82e667646debd27522ad4101fd9bdebe5f66d08	PE32	2022-02-17 15:13:49	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/HasOverlay YRP/borland_delphi YRP/domain YRP/contentis_base64 YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_token YRP/win_files_operation YRP/win_hook YRP/Delphi_FormShow YRP/Delphi_Copy YRP/Delphi_StrToInt
fd6361aac0b738aff31ddde547b61aaeca397710d883b09742f9ae5720773bf2	PE32	2022-02-17 14:35:15	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsBeyondImageSize YRP/borland_delphi YRP/domain YRP/url YRP/contentis_base64 YRP/network_dropper YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/Delphi_Copy FlorianRoth/DragonFly_APT_Sep17_3
19b9b25becb8e95f6edf134799071c8a2c722b37a83e6b8a923b2aa82ac4db87	PE32	2022-02-17 06:24:17	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/borland_delphi YRP/domain YRP/contentis_base64 YRP/ThreadControl__Context YRP/inject_thread YRP/win_mutex YRP/win_registry YRP/xtreme_rat
e5f17a4a43347128b9f8ef240dd57c5fe112cb096aa9ff0a66ddf4850a1d5247	PE32	2022-02-17 06:06:09	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/borland_delphi YRP/borland_delphi_dll YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/Browsers YRP/Dropper_Strings YRP/Obfuscated_Strings YRP/Misc_Suspicious_Strings YRP/hijack_network YRP/create_service YRP/network_udp_sock YRP/network_tcp_listen YRP/network_tcp_socket YRP/network_dns YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/sniff_audio YRP/spreading_share YRP/rat_webcam YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/win_hook YRP/Big_Numbers1 YRP/Big_Numbers3 YRP/CRC32_poly_Constant YRP/CRC32_table YRP/Delphi_Random YRP/Delphi_FormShow YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Delphi_DecodeDate YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API YRP/FVEY_ShadowBrokers_Jan17_Screen_Strings
4b896a7534aaed8fea1447afe7253633c0297a7a709f90af41996a10dbf91a68	PE32	2022-02-17 05:27:33	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/borland_delphi YRP/domain YRP/contentis_base64 YRP/keylogger YRP/win_registry FlorianRoth/DragonFly_APT_Sep17_3
52f61cdfea0359112fef54a7d1a39a3a0535f66b30b8db9a805d7e7cda73cb28	PE32	2022-02-17 04:23:59	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/borland_delphi YRP/borland_delphi_dll YRP/domain YRP/IP YRP/contentis_base64 YRP/Browsers YRP/Dropper_Strings YRP/DebuggerCheck__QueryInfo YRP/Check_OutputDebugStringA_iat YRP/anti_dbg YRP/create_service YRP/network_udp_sock YRP/network_tcp_listen YRP/network_tcp_socket YRP/network_dns YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/sniff_audio YRP/spreading_share YRP/rat_webcam YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/win_hook YRP/Big_Numbers1 YRP/CRC32_poly_Constant YRP/CRC32_table YRP/Delphi_Random YRP/Delphi_FormShow YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Delphi_DecodeDate YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API YRP/FVEY_ShadowBrokers_Jan17_Screen_Strings
26ca073fafeef7ec66ff25f04b29455f465403e57d5c7e8428eba17389c730b5	PE32	2022-02-17 03:44:04	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/IsPE32 YRP/IsWindowsGUI [+] YRP/borland_delphi YRP/domain YRP/contentis_base64 YRP/DebuggerCheck__QueryInfo YRP/ThreadControl__Context YRP/Check_OutputDebugStringA_iat YRP/anti_dbg YRP/inject_thread YRP/create_service YRP/escalate_priv YRP/win_mutex YRP/win_token YRP/win_files_operation YRP/Delphi_Random YRP/Delphi_CompareCall YRP/Delphi_Copy FlorianRoth/DragonFly_APT_Sep17_3
e283a39ce2c3d17d1fc3d37a35f2a68ad7fdbe86f0e8d9254f4e30a35fe30742	PE32	2022-02-16 21:39:34	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/PrivateexeProtectorV18SetiSoftTeam [+] YRP/PrivateEXEProtector197SetiSoft YRP/PrivateexeProtector20SetiSoftTeam YRP/IsPE32 YRP/IsWindowsGUI YRP/borland_delphi_dll YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/Browsers YRP/Dropper_Strings YRP/DebuggerCheck__QueryInfo YRP/Check_OutputDebugStringA_iat YRP/anti_dbg YRP/create_service YRP/network_udp_sock YRP/network_tcp_listen YRP/network_tcp_socket YRP/network_dns YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/sniff_audio YRP/spreading_share YRP/rat_webcam YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/win_hook YRP/Big_Numbers1 YRP/CRC32_poly_Constant YRP/CRC32_table YRP/Delphi_Random YRP/Delphi_FormShow YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Delphi_DecodeDate YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API YRP/FVEY_ShadowBrokers_Jan17_Screen_Strings
fd2f8af065e513185886b711094de0f8fd7ce9c40d6be8cf8a374993b1960bdc	PE32	2022-02-16 21:18:30	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/borland_delphi YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/Browsers YRP/VMWare_Detection YRP/vmdetect YRP/antivm_vmware YRP/network_udp_sock YRP/network_tcp_listen YRP/network_tcp_socket YRP/network_dns YRP/network_ssl YRP/screenshot YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/CRC32_poly_Constant YRP/CRC32_table YRP/BASE64_table YRP/Delphi_Random YRP/Delphi_RandomRange YRP/Delphi_FormShow YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Delphi_DecodeDate YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API YRP/CookieTools YRP/suspicious_packer_section
bf6d2bbc77bb38df40ea5076134ddc1618d753b8752df8ac16d633ed14d5db7c	PE32	2022-02-16 16:19:11	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/D1S1Gv11betaD1N YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/borland_delphi YRP/domain YRP/IP YRP/contentis_base64 YRP/network_tcp_socket YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Str_Win32_Winsock2_Library FlorianRoth/DragonFly_APT_Sep17_3
9896dceba0ee662f1c55798633b3a9db0f19f5431240f84370d9efd28faea511	PE32	2022-02-16 05:14:21	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/borland_delphi YRP/domain YRP/contentis_base64 YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/Delphi_Copy
15ad59acd44fec030ddfb1c2d814644b68b60c13fa5e2ebe05b602dd266d1a2d	PE32	2022-02-16 03:35:09	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/IsBeyondImageSize YRP/borland_delphi YRP/domain YRP/contentis_base64 YRP/ThreadControl__Context YRP/inject_thread YRP/win_mutex YRP/win_registry YRP/xtreme_rat
1ae9d032f93c9ad9577a759604a33945d9a3b1f92845addf39296c1ae77502ae	MS-DOS	2022-02-16 02:52:02	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/HasModified_DOS_Message YRP/borland_delphi YRP/maldoc_getEIP_method_1 YRP/domain YRP/contentis_base64 YRP/ThreadControl__Context YRP/inject_thread YRP/win_mutex YRP/win_registry YRP/suspicious_packer_section YRP/xtreme_rat
fbc21e6aaeba66197a69a7bb153bd3a2de10c431720e3b8091c44bac3cfb469c	PE32	2022-02-16 01:45:11	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/MaskPEV20yzkzero [+] YRP/BeRoEXEPackerV100BeRo YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/domain YRP/url YRP/contentis_base64 YRP/Browsers YRP/Dropper_Strings YRP/Check_OutputDebugStringA_iat YRP/anti_dbg YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/suspicious_packer_section
125834ab80d6d5844847d397a9e7d3db0709e157dd277515ad618f165c86ab9d	PE32	2022-02-16 01:32:30	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/borland_delphi YRP/domain YRP/contentis_base64 YRP/Dropper_Strings YRP/ThreadControl__Context YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/Delphi_Random FlorianRoth/DragonFly_APT_Sep17_3
441b110e224085183c824ebedd44213c3ea3186164a0981e9599a6a9cfd07337	PE32	2022-02-16 01:29:45	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/borland_delphi YRP/domain YRP/contentis_base64 YRP/Obfuscated_Strings YRP/keylogger YRP/win_registry
c1bc92448f3003c16a1380465a26ead7230ed67ddf9977e1d7c50058a713f33d	PE32	2022-02-16 00:02:04	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/borland_delphi YRP/domain YRP/contentis_base64 YRP/Obfuscated_Strings YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/Delphi_CompareCall YRP/Delphi_Copy
4435e8b40dc27a6d1118e5d38eafa826b4be2eab9495b33bf017d0e012c1ce81	PE32	2022-02-15 22:40:54	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/borland_delphi YRP/domain YRP/contentis_base64 YRP/ThreadControl__Context YRP/inject_thread YRP/win_mutex YRP/win_registry YRP/xtreme_rat
c83510e3183eff2e5c8143954e046973e8e52b08189bc6ec98f7ab3156faa27d	PE32	2022-02-15 20:15:44	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/borland_delphi YRP/borland_delphi_dll YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/Browsers YRP/Dropper_Strings YRP/Obfuscated_Strings YRP/Check_OutputDebugStringA_iat YRP/anti_dbg YRP/create_service YRP/network_udp_sock YRP/network_tcp_listen YRP/network_tcp_socket YRP/network_dns YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/sniff_audio YRP/spreading_share YRP/rat_webcam YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/win_hook YRP/Big_Numbers1 YRP/Big_Numbers3 YRP/CRC32_poly_Constant YRP/CRC32_table YRP/Delphi_Random YRP/Delphi_FormShow YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Delphi_DecodeDate YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API YRP/FVEY_ShadowBrokers_Jan17_Screen_Strings
7d2be98c91460be99afcf7df3895c4979b829552b8e952b3a871f332c3edde1c	PE32	2022-02-15 17:52:14	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/borland_delphi YRP/domain YRP/contentis_base64 YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/Delphi_CompareCall YRP/Delphi_Copy
0ced0f3736c0f3ce864019cf7011597634d2b33c5ceaa947a5cc6ec4d49b8be4	PE32	2022-02-11 02:14:42	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/borland_delphi YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/System_Tools YRP/Browsers YRP/Antivirus YRP/Dropper_Strings YRP/WMI_strings YRP/Misc_Suspicious_Strings YRP/DebuggerCheck__QueryInfo YRP/anti_dbg YRP/network_ssl YRP/escalate_priv YRP/screenshot YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/win_hook YRP/CRC32_poly_Constant YRP/CRC32_table YRP/MD5_Constants YRP/RijnDael_AES_CHAR YRP/RijnDael_AES_LONG YRP/BASE64_table YRP/DCP_RIJNDAEL_Init YRP/with_sqlite YRP/GenerateTLSClientHelloPacket_Test
e3d04c4c0195fd80348da3cfc9d9d57bbe9b08d3036bd36def4a2ff760a96a99	PE32	2022-02-03 15:03:17	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/borland_delphi YRP/domain YRP/contentis_base64 YRP/ThreadControl__Context YRP/inject_thread YRP/win_mutex YRP/win_registry YRP/xtreme_rat
a1702ec12c2bf4a52e11fbdab6156358084ad2c662c8b3691918ef7eabacde96	PE32	2022-02-03 15:02:18	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/borland_delphi YRP/domain YRP/contentis_base64 YRP/ThreadControl__Context YRP/inject_thread YRP/win_mutex YRP/win_registry YRP/xtreme_rat
f616b30e229baf950e77ff1c06704027d8bb85d933bf6b8e96463f77bd26a1fd	PE32	2021-11-02 03:00:54	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Armadillo_v4x YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/borland_delphi YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/Browsers YRP/Antivirus YRP/Dropper_Strings YRP/anti_dbg YRP/network_tcp_socket YRP/network_ssl YRP/screenshot YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/Big_Numbers1 YRP/CRC32_poly_Constant YRP/CRC32_table YRP/MD5_Constants YRP/RijnDael_AES_CHAR YRP/RijnDael_AES_LONG YRP/BASE64_table YRP/DCP_RIJNDAEL_Init YRP/Str_Win32_Winsock2_Library YRP/GenerateTLSClientHelloPacket_Test
c82cc443d4f6785b6ef186b90f50ca370f585edc32a2a103ebea99ff44b0ef75	PE32	2021-10-23 03:57:18	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/borland_delphi YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/Antivirus YRP/anti_dbg YRP/network_ssl YRP/screenshot YRP/win_mutex YRP/win_token YRP/win_files_operation YRP/CRC32_poly_Constant YRP/CRC32_table YRP/MD5_Constants YRP/BASE64_table YRP/Str_Win32_Wininet_Library YRP/GenerateTLSClientHelloPacket_Test
3440733161516c2cb389ff12132bab7f15470df2a78d504c0e945b96e84d8222	PE32	2021-10-23 03:29:33	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/borland_delphi YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/System_Tools YRP/Browsers YRP/Antivirus YRP/Dropper_Strings YRP/WMI_strings YRP/Misc_Suspicious_Strings YRP/DebuggerCheck__QueryInfo YRP/anti_dbg YRP/network_ssl YRP/escalate_priv YRP/screenshot YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/win_hook YRP/CRC32_poly_Constant YRP/CRC32_table YRP/MD5_Constants YRP/RijnDael_AES_CHAR YRP/RijnDael_AES_LONG YRP/BASE64_table YRP/DCP_RIJNDAEL_Init YRP/with_sqlite YRP/GenerateTLSClientHelloPacket_Test
70a02538e29f42dd5808bda9017a826d6cf2717347cc2c411a3b4e368b1344d6	PE32	2021-09-14 11:42:23	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/borland_delphi YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Obfuscated_Strings YRP/Check_Dlls YRP/vmdetect YRP/anti_dbg YRP/anti_dbgtools YRP/antisb_joesanbox YRP/antisb_anubis YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/antisb_cwsandbox YRP/antivm_virtualbox YRP/inject_thread YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/Delphi_CompareCall YRP/Delphi_Copy
9068d4510f0f1f7abc7d98ac79909ed8ce66863f1020338cfb5ad010e250e342	PE32	2021-09-02 10:01:24	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/borland_delphi YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Obfuscated_Strings YRP/Check_Dlls YRP/vmdetect YRP/anti_dbg YRP/anti_dbgtools YRP/antisb_joesanbox YRP/antisb_anubis YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/antisb_cwsandbox YRP/antivm_virtualbox YRP/inject_thread YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/Delphi_CompareCall YRP/Delphi_Copy
9fe884ca772feb54de9c8bcc395901d25ad7b5bd5f75e440562cb9b5c590c04c	PE32	2021-09-02 01:19:31	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/borland_delphi YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/Browsers YRP/anti_dbg YRP/network_ssl YRP/screenshot YRP/win_mutex YRP/win_files_operation YRP/Big_Numbers1 YRP/CRC32_poly_Constant YRP/CRC32_table YRP/MD5_Constants YRP/BASE64_table YRP/Str_Win32_Wininet_Library YRP/GenerateTLSClientHelloPacket_Test
3bb0bde2f2da6139b923eb94d6efbb5aedfaf7ec4ae660431aff4da4efd125e8	PE32	2021-08-27 01:01:39	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/borland_delphi YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/System_Tools YRP/Browsers YRP/Antivirus YRP/Dropper_Strings YRP/WMI_strings YRP/Misc_Suspicious_Strings YRP/DebuggerCheck__QueryInfo YRP/anti_dbg YRP/network_ssl YRP/escalate_priv YRP/screenshot YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/win_hook YRP/CRC32_poly_Constant YRP/CRC32_table YRP/MD5_Constants YRP/RijnDael_AES_CHAR YRP/RijnDael_AES_LONG YRP/BASE64_table YRP/DCP_RIJNDAEL_Init YRP/with_sqlite YRP/GenerateTLSClientHelloPacket_Test
00ff73f26df45c054698f9a68077a1073c992b791372b787a57428749080899d	PE32	2021-07-26 13:07:00	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/borland_delphi YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/Dropper_Strings YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_token YRP/win_files_operation YRP/Big_Numbers0 YRP/Big_Numbers1 YRP/Prime_Constants_long YRP/MD5_Constants YRP/FGint_MontgomeryModExp YRP/FGint_DivMod YRP/FGint_FGIntDestroy YRP/FGint_Base10StringToGInt YRP/FGint_Base256StringToGInt YRP/FGint_RSAEncrypt YRP/FGint_RsaDecrypt YRP/Delphi_Random YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Delphi_DecodeDate YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API
5ff01cd39b8036132ee2f0f92de13926de2106343ecdae12604d93a522ac3029	PE32	2021-07-26 13:04:01	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/borland_delphi YRP/domain YRP/url YRP/contentis_base64 YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/MD5_Constants YRP/DES_Long YRP/BASE64_table YRP/Delphi_Random YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Delphi_DecodeDate
c7d3f33a192a7b3c766145a9abeb14425333fca327a72a73754544d0f8d462cd	PE32	2021-07-26 13:03:54	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/HasOverlay YRP/HasModified_DOS_Message YRP/borland_delphi YRP/domain YRP/url YRP/contentis_base64 YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/MD5_Constants YRP/DES_Long YRP/BASE64_table YRP/Delphi_Random YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Delphi_DecodeDate
9fd3b7f9a970583a2ccdcb33ffdd420a45fe51e7e5ffdddc54c0c306cabe3f1b	PE32	2021-07-16 01:22:45	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/borland_delphi YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/System_Tools YRP/Browsers YRP/Antivirus YRP/Dropper_Strings YRP/WMI_strings YRP/Misc_Suspicious_Strings YRP/DebuggerCheck__QueryInfo YRP/anti_dbg YRP/network_ssl YRP/escalate_priv YRP/screenshot YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/win_hook YRP/CRC32_poly_Constant YRP/CRC32_table YRP/MD5_Constants YRP/RijnDael_AES_CHAR YRP/RijnDael_AES_LONG YRP/BASE64_table YRP/DCP_RIJNDAEL_Init YRP/with_sqlite YRP/GenerateTLSClientHelloPacket_Test
9e77e2a0cdb91d1deca51b2e8187f7793ce9ab3cb800adca6e7e3dd594023ad5	PE32	2021-05-27 06:02:08	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/borland_delphi YRP/domain YRP/IP YRP/contentis_base64 YRP/Misc_Suspicious_Strings YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Delphi_DecodeDate
986b2aa599556c6cc1ac7b93aee222417ff9df3c26f8a4821d6eee11f237b9ce	PE32	2021-05-18 16:03:30	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/UPXv20MarkusLaszloReiser [+] YRP/UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser YRP/UPX20030XMarkusOberhumerLaszloMolnarJohnReiser YRP/D1S1Gv11betaD1N YRP/IsPE32 YRP/IsWindowsGUI YRP/borland_delphi YRP/borland_delphi_dll YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/System_Tools YRP/Browsers YRP/inject_thread YRP/network_tcp_listen YRP/network_tcp_socket YRP/network_dns YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/sniff_audio YRP/rat_webcam YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/win_hook YRP/CRC32_poly_Constant YRP/CRC32_table YRP/Delphi_Random YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Str_Win32_Winsock2_Library YRP/UPX YRP/suspicious_packer_section
9f1d61d16b505064c9cba003630c09b1d09f25e3e42deeaacb105a7b246d49e2	PE32	2021-04-03 01:28:19	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/borland_delphi YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/keylogger YRP/win_registry YRP/win_files_operation
006ad091bf9033d29dc742d4957e1695099cdedd38ab5d065529dc6d324b7115	PE32	2021-04-02 01:01:34	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/borland_delphi YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/WMI_strings YRP/Misc_Suspicious_Strings YRP/anti_dbg YRP/network_ssl YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/android_meterpreter YRP/CRC32_poly_Constant YRP/CRC32_table YRP/CRC32b_poly_Constant YRP/MD5_Constants YRP/OpenSSL_DSA YRP/BASE64_table YRP/Delphi_Random YRP/Delphi_FormShow YRP/GenerateTLSClientHelloPacket_Test
df42b61e944577153f8cd248d4c0ffb4435a5260d058bd41c59a5092ad1fcc57	PE32	2021-03-25 23:53:50	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/HasOverlay YRP/borland_delphi YRP/domain YRP/contentis_base64 YRP/network_dropper YRP/win_registry YRP/win_files_operation YRP/Delphi_CompareCall
c672df042c8593244973a520ab3500c3e8c996f266c93f9e3ca8c89b924be793	PE32	2021-03-25 23:30:21	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/borland_delphi YRP/domain YRP/url YRP/contentis_base64 YRP/maldoc_OLE_file_magic_number YRP/keylogger YRP/win_registry YRP/win_files_operation
3cbb2fb258375bad926e4c3ddd7e1f6f6490bccd946fca66ba4bfc170d30d524	PE32	2020-11-16 02:25:55	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsBeyondImageSize YRP/borland_delphi YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/System_Tools YRP/Dropper_Strings YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/android_meterpreter YRP/Big_Numbers1 YRP/CRC32_poly_Constant YRP/CRC32_table YRP/MD5_Constants YRP/Delphi_FormShow YRP/Delphi_CompareCall YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API YRP/GenerateTLSClientHelloPacket_Test
f160eabf2bf6d1dc81a45c90e7eefe9dd7f06205115b1da82b391326f760ba05	PE32	2020-11-15 02:04:25	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsBeyondImageSize YRP/borland_delphi YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/System_Tools YRP/Dropper_Strings YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/Big_Numbers1 YRP/CRC32_poly_Constant YRP/CRC32_table YRP/MD5_Constants YRP/Delphi_FormShow YRP/Delphi_CompareCall YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API YRP/GenerateTLSClientHelloPacket_Test
fe69fa21ed97a962bc9aa9fdaca39f5249fa178f05246371f901d35c13ced9ea	PE32	2020-10-20 01:31:12	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/borland_delphi YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/System_Tools YRP/Dropper_Strings YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/android_meterpreter YRP/Big_Numbers1 YRP/CRC32_poly_Constant YRP/CRC32_table YRP/MD5_Constants YRP/Delphi_FormShow YRP/Delphi_CompareCall YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API YRP/GenerateTLSClientHelloPacket_Test
6a17a7a12c7ef295d0778287c476b588658a4b503e2e34ad1578280062f86765	PE32	2020-06-30 17:50:00	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/borland_delphi YRP/domain YRP/contentis_base64 YRP/DebuggerCheck__QueryInfo YRP/ThreadControl__Context YRP/Check_OutputDebugStringA_iat YRP/anti_dbg YRP/inject_thread YRP/create_service YRP/escalate_priv YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/Delphi_Random YRP/Delphi_CompareCall YRP/Delphi_Copy
14a57cabd5abe726dabd1f3e7cefcfa241bca0c16e912fe4c498e14a4f3b1873	PE32	2020-06-30 16:52:05	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/borland_delphi YRP/borland_delphi_dll YRP/domain YRP/IP YRP/contentis_base64 YRP/Browsers YRP/Dropper_Strings YRP/DebuggerCheck__QueryInfo YRP/Check_OutputDebugStringA_iat YRP/anti_dbg YRP/create_service YRP/network_udp_sock YRP/network_tcp_listen YRP/network_tcp_socket YRP/network_dns YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/sniff_audio YRP/spreading_share YRP/rat_webcam YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/win_hook YRP/Big_Numbers1 YRP/CRC32_poly_Constant YRP/CRC32_table YRP/Delphi_Random YRP/Delphi_FormShow YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Delphi_DecodeDate YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API YRP/FVEY_ShadowBrokers_Jan17_Screen_Strings
1144c446ebc25e9f97b097806470f61f98a3b532a197855cf4eceab216496088	PE32	2020-06-30 12:24:09	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/UPXv20MarkusLaszloReiser [+] YRP/UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser YRP/UPX20030XMarkusOberhumerLaszloMolnarJohnReiser YRP/D1S1Gv11betaD1N YRP/IsPE32 YRP/IsWindowsGUI YRP/borland_delphi YRP/borland_delphi_dll YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/System_Tools YRP/Browsers YRP/inject_thread YRP/network_tcp_listen YRP/network_tcp_socket YRP/network_dns YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/sniff_audio YRP/rat_webcam YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/win_hook YRP/CRC32_poly_Constant YRP/CRC32_table YRP/Delphi_Random YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Str_Win32_Winsock2_Library YRP/UPX YRP/suspicious_packer_section
acb609dff7649d4892baf18732a92392b17828dddda94488f8644a19f2531fec	PE32	2020-06-29 15:50:55	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/IsPE32 YRP/IsWindowsGUI [+] YRP/IsBeyondImageSize YRP/borland_delphi YRP/domain YRP/BITS_CLSID YRP/Delphi_Random YRP/Delphi_CompareCall FlorianRoth/DragonFly_APT_Sep17_3
01b4d501a7a54a57bd5608cd1aa0f6362aeacec2685cb163a51adc50819b572e	PE32	2020-06-29 11:18:01	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsBeyondImageSize YRP/borland_delphi YRP/domain YRP/url YRP/contentis_base64 YRP/System_Tools YRP/network_dropper YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/Delphi_Random YRP/Delphi_Copy
1176c8b2740e9154472250762034db07f2320ba14dcbfb2a31039c13fd397ccb	PE32	2020-06-27 20:49:22	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/borland_delphi YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/contentis_base64 YRP/Browsers YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Obfuscated_Strings YRP/Check_Dlls YRP/vmdetect YRP/anti_dbg YRP/anti_dbgtools YRP/antisb_joesanbox YRP/antisb_anubis YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/antisb_cwsandbox YRP/antivm_virtualbox YRP/inject_thread YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/Delphi_CompareCall YRP/Delphi_Copy
1170caf69416655a721210992773e55e29a4193a2d78b5b778551afd11f06ba1	PE32	2020-06-27 19:14:53	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/borland_delphi YRP/domain YRP/contentis_base64 YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/Delphi_Copy
117d3aae830af05485a0815e077a59367b0c346e666857a303e5537bf6ce349c	PE32	2020-06-27 18:42:36	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/borland_delphi YRP/domain YRP/url YRP/contentis_base64 YRP/System_Tools YRP/keylogger YRP/win_registry YRP/win_private_profile YRP/win_files_operation YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API
11d974cbb620ba40566b061fc0a590d1652e0a60fdb3defc64521589430e2ba0	PE32	2020-06-27 14:16:37	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/borland_delphi YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/contentis_base64 YRP/Browsers YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Obfuscated_Strings YRP/Check_Dlls YRP/vmdetect YRP/anti_dbg YRP/anti_dbgtools YRP/antisb_joesanbox YRP/antisb_anubis YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/antisb_cwsandbox YRP/antivm_virtualbox YRP/inject_thread YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/Delphi_CompareCall YRP/Delphi_Copy
11b7cf0bda1d405cc9c966297d18c4f1dd51ef6c91a4be0bfe7c755ea769762a	PE32	2020-06-27 11:43:41	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/HasOverlay YRP/borland_delphi YRP/domain YRP/contentis_base64 YRP/antivm_vmware YRP/network_udp_sock YRP/network_tcp_listen YRP/network_tcp_socket YRP/network_dns YRP/screenshot YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/Delphi_Random YRP/Delphi_FormShow YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Str_Win32_Winsock2_Library
b80db196211f576d5851e03267ad4d659143547090a95ecd6ea1a234cb2af911	PE32	2020-06-27 11:36:52	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/borland_delphi YRP/domain YRP/contentis_base64 YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/MD5_Constants YRP/RIPEMD160_Constants YRP/SHA1_Constants YRP/BASE64_table YRP/Delphi_Random YRP/Delphi_FormShow YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Delphi_DecodeDate YRP/DCP_RIJNDAEL_Init
1118b074505b8e3c876f3899e089a88d707791e10e9c99c0214b713e8f1a3422	PE32	2020-06-26 18:57:03	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/borland_delphi YRP/domain YRP/contentis_base64 YRP/keylogger YRP/win_registry YRP/win_files_operation FlorianRoth/DragonFly_APT_Sep17_3
82fbb7707cb5bbe71acbaee22c764415cb83ac81d7662f3638c163b48efe9ad0	PE32	2020-06-26 18:31:26	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/Upackv039finalDwing [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/IsBeyondImageSize YRP/borland_delphi YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/network_tcp_socket YRP/network_dns YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/Delphi_Random YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Delphi_DecodeDate YRP/Str_Win32_Winsock2_Library
25215f59c5e5fdee2170f5fcc0d310e226a9a9bf5be704500c87f4cf5c8fc628	PE32	2020-04-23 01:10:18	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/borland_delphi YRP/domain YRP/url YRP/contentis_base64 YRP/anti_dbg YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Delphi_FormShow
a822fea97052dd7ef0e898d9a2813bd5aa15d65a41bddf108adc20f230c223af	PE32	2020-04-16 01:07:05	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/borland_delphi YRP/domain YRP/url YRP/contentis_base64 YRP/anti_dbg YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Delphi_FormShow
dffecf72fc07c7d8e3eefed16c0c0038200f28492e94ba4ff402e4ec9f5b42fe	PE32	2020-04-12 01:13:02	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/borland_delphi YRP/domain YRP/url YRP/contentis_base64 YRP/anti_dbg YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Delphi_FormShow
e6c04f71db124183906fb340716ca7085b722e70589dde8bcde1078f417d5792	PE32	2020-03-16 02:16:53	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/borland_delphi YRP/domain YRP/url YRP/contentis_base64 YRP/anti_dbg YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Delphi_FormShow
fead0fe8ea381c799177caab0ecde0b42d4a673766cbf0b42de6460654a97197	PE32	2020-02-12 02:06:59	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/borland_delphi YRP/domain YRP/url YRP/contentis_base64 YRP/anti_dbg YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Delphi_FormShow
2e5f2dba33753cf592e22cd44e6ad5107589cbb6d667536bf3a225afa9392b22	PE32	2020-01-24 02:20:24	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsBeyondImageSize YRP/borland_delphi YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/System_Tools YRP/Dropper_Strings YRP/anti_dbg YRP/network_ssl YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_token YRP/win_files_operation YRP/win_hook YRP/CRC32_poly_Constant YRP/CRC32_table YRP/MD5_Constants YRP/OpenSSL_DSA YRP/BASE64_table YRP/Delphi_Random YRP/Delphi_FormShow YRP/GenerateTLSClientHelloPacket_Test
1af5dc963e41a341ec7e2d2680ea38bc83f30e21d84795f7fe81c65c4364d272	PE32	2020-01-15 16:56:11	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/D1S1Gv11betaD1N [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/borland_delphi YRP/domain YRP/contentis_base64 YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/Delphi_Random YRP/Delphi_CompareCall YRP/Delphi_Copy FlorianRoth/DragonFly_APT_Sep17_3
415168b684376b31cc4f271d6a70853ec512932440951873f777671180c41bed	PE32	2020-01-15 15:05:20	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/HasOverlay YRP/borland_delphi YRP/domain YRP/contentis_base64 YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/MD5_Constants YRP/RIPEMD160_Constants YRP/SHA1_Constants YRP/BASE64_table YRP/Delphi_Random YRP/Delphi_FormShow YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/DCP_RIJNDAEL_Init
9e55387499c130cba909a8cb2f17b74fa99ad1ed7597db0ec92bd41be0f699f0	PE32	2020-01-15 12:03:03	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/borland_delphi YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/contentis_base64 YRP/DebuggerCheck__QueryInfo YRP/ThreadControl__Context YRP/inject_thread YRP/escalate_priv YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/Delphi_CompareCall YRP/Delphi_Copy
e43e1caf0bef2e116be3b900b6c037664cc3a60fc32ddd9f88d77ce168b2b844	PE32	2020-01-15 11:02:41	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/D1S1Gv11betaD1N [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsBeyondImageSize YRP/borland_delphi YRP/borland_delphi_dll YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/System_Tools YRP/Browsers YRP/inject_thread YRP/network_tcp_listen YRP/network_tcp_socket YRP/network_dns YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/sniff_audio YRP/rat_webcam YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/win_hook YRP/CRC32_poly_Constant YRP/CRC32_table YRP/Delphi_Random YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Str_Win32_Winsock2_Library
1766f0547b6e9954da7410bc5cb33a494349fb36af3e2ca8a734d884cceff14b	PE32	2020-01-15 09:31:54	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/borland_delphi YRP/borland_delphi_dll YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/Browsers YRP/Dropper_Strings YRP/DebuggerCheck__QueryInfo YRP/anti_dbg YRP/create_service YRP/network_udp_sock YRP/network_tcp_listen YRP/network_tcp_socket YRP/network_dns YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/sniff_audio YRP/spreading_share YRP/rat_webcam YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/win_hook YRP/Big_Numbers1 YRP/CRC32_poly_Constant YRP/CRC32_table YRP/Delphi_Random YRP/Delphi_FormShow YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Delphi_DecodeDate YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API YRP/FVEY_ShadowBrokers_Jan17_Screen_Strings
7a71f90d4c7fa1849b8a1b2a80bf1e196b231883b917dd598455b6060de0d8cd	PE32	2020-01-15 09:17:53	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsBeyondImageSize YRP/borland_delphi YRP/borland_delphi_dll YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/Browsers YRP/Dropper_Strings YRP/Obfuscated_Strings YRP/Check_OutputDebugStringA_iat YRP/anti_dbg YRP/create_service YRP/network_udp_sock YRP/network_tcp_listen YRP/network_tcp_socket YRP/network_dns YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/sniff_audio YRP/spreading_share YRP/rat_webcam YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/win_hook YRP/Big_Numbers1 YRP/Big_Numbers3 YRP/CRC32_poly_Constant YRP/CRC32_table YRP/Delphi_Random YRP/Delphi_FormShow YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Delphi_DecodeDate YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API
9f2855a2ca6d90d0a50d0366eefb7d2a630559d5df8a18eed81cfa0807af079d	PE32	2020-01-15 08:46:57	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsBeyondImageSize YRP/borland_delphi YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/Dropper_Strings YRP/create_service YRP/network_udp_sock YRP/network_tcp_listen YRP/network_tcp_socket YRP/network_dns YRP/network_ssl YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/CRC32_poly_Constant YRP/CRC32_table YRP/BASE64_table YRP/Delphi_FormShow YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Delphi_DecodeDate YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API
fd47470e86dc23187f8204ed818f3e69cb7bde44c7535b9b5bc895e5747b54d0	PE32	2020-01-15 08:46:28	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/IsPE32 YRP/IsWindowsGUI [+] YRP/HasOverlay YRP/borland_delphi YRP/domain YRP/url YRP/contentis_base64 YRP/Dropper_Strings YRP/network_tcp_listen YRP/network_tcp_socket YRP/network_dns YRP/escalate_priv YRP/win_registry YRP/win_token YRP/win_files_operation YRP/Delphi_Random YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library
076b23caa60fbfce063ce55f1de7bbddca614c0dfc198a747cc7d58ae3143eff	PE32	2020-01-15 08:17:31	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/HasOverlay YRP/borland_delphi YRP/domain YRP/contentis_base64 YRP/Obfuscated_Strings YRP/keylogger YRP/win_registry
f08fcb5d93ddc78fc028a314aae9f2399bc214f0f128f7a9fa7fc164697417cd	PE32	2020-01-13 20:02:08	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/PECompactv2xx [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/IsBeyondImageSize YRP/borland_delphi YRP/domain YRP/IP YRP/contentis_base64 YRP/Dropper_Strings YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/Delphi_Random YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Delphi_DecodeDate YRP/suspicious_packer_section
69507a32b67939c2cfd43b85ec2381f32fe4707b29d79c18a5becdb7f5082b57	PE32	2020-01-13 18:10:21	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsBeyondImageSize YRP/borland_delphi YRP/domain YRP/contentis_base64 YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Delphi_StrToInt
f39d6fb9a4c5e5bbee2fb985d9335fb4f2f1fe52f844f56a219f1a2f675c55e0	PE32	2020-01-13 16:47:19	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsBeyondImageSize YRP/borland_delphi YRP/borland_delphi_dll YRP/domain YRP/url YRP/contentis_base64 YRP/network_http YRP/keylogger YRP/spreading_file YRP/win_registry YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/MD5_Constants YRP/BASE64_table YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API
c15b894581e88cbf14845d945ec7d5c64eca1b6ee279ed42234c6e986717378e	PE32	2020-01-13 15:10:29	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/IsBeyondImageSize YRP/borland_delphi YRP/domain YRP/contentis_base64 YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/RIPEMD160_Constants YRP/SHA1_Constants YRP/BASE64_table YRP/Delphi_FormShow YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Delphi_DecodeDate
309e893d7369b4a4244e8af6dcb260e1469103f2fc1b3293bad9351125810d9a	PE32	2020-01-13 12:37:16	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/domain YRP/contentis_base64 YRP/System_Tools YRP/Antivirus YRP/Dropper_Strings YRP/Misc_Suspicious_Strings YRP/disable_antivirus YRP/keylogger YRP/win_registry YRP/win_private_profile YRP/win_files_operation
3cada4d3af7b62d0c5fd47340608e4fae1cd4aa3c73ae3f8a02d92c132b12790	PE32	2020-01-07 02:04:02	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/borland_delphi YRP/domain YRP/url YRP/contentis_base64 YRP/anti_dbg YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Delphi_FormShow
eac3aa7cbdca01a99a366f229743deb3179fa4a784d9aa95431d0c5d7a171c51	PE32	2019-12-29 02:26:11	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/borland_delphi YRP/domain YRP/url YRP/contentis_base64 YRP/anti_dbg YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Delphi_FormShow
9e2b3f94ca120e44d3d48422eb0f35aadc7dd23abefb0ec2f08aefc2ad1214f1	PE32	2019-12-24 02:10:47	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/borland_delphi YRP/domain YRP/url YRP/contentis_base64 YRP/anti_dbg YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Delphi_FormShow
641b1c332767c55a1140ce38accb375ee95c6f4699028d2b1e23c970344d0980	PE32	2019-12-15 02:21:28	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/borland_delphi YRP/domain YRP/url YRP/contentis_base64 YRP/anti_dbg YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Delphi_FormShow
a0761b671caf344d8b1a1d3777bc33555d4eedfbb61ed4e262860ad81f4f6692	PE32	2019-12-11 02:13:06	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/borland_delphi YRP/domain YRP/url YRP/contentis_base64 YRP/anti_dbg YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Delphi_FormShow
305bb091422d1d48edd853edcd37754abaf6ad25b4233d6cb2d1844402b88ab8	PE32	2019-12-02 19:28:33	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsBeyondImageSize YRP/borland_delphi YRP/without_images YRP/without_attachments YRP/without_urls YRP/domain YRP/IP YRP/contentis_base64 YRP/network_smtp_raw YRP/network_dropper YRP/network_tcp_socket YRP/network_dns YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_private_profile YRP/win_files_operation YRP/BASE64_table YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library
8c9fc3460a8b1dcf502f8581b0beeac2429368542c5237f3ffbb2e52e7d33c18	PE32	2019-12-02 18:55:37	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/D1S1Gv11betaD1N [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/borland_delphi YRP/domain YRP/url YRP/contentis_base64 YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Delphi_DecodeDate YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/UPX YRP/suspicious_packer_section
25c4d1a50d013470ea1900b11e8c47ad00e6813b6ac2c13e7c59c722efdbce90	PE32	2019-12-02 18:54:23	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland YRP/D1S1Gv11betaD1N [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsBeyondImageSize YRP/borland_delphi YRP/borland_delphi_dll YRP/domain YRP/IP YRP/contentis_base64 YRP/Dropper_Strings YRP/network_tcp_socket YRP/network_dns YRP/keylogger YRP/win_registry YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Str_Win32_Winsock2_Library

Recent Searches
yrp/borland_delphi_60_70
yrp/webshell_jsp_reverse_jsp_reverse_jspbd
yrp/mithril_v1_45_dlltest
yrp/webshell_casus_1_5
yrp/upackv036betadwing
yrp/hkdoordll
yrp/eqgrp_eligiblecandidate
yrp/webshell_jsp_up
yrp/bin_server
yrp/rem_view_php_php

Search

Recent Searches