MD5: 565d6e2f8ed24de7c3d36b9c277c4cf9
SHA1: b497d73a2cc76a5aa913a2be2927fb7cde761b14
SHA256: ca91be01e0d47e0b64e496001dfa92c11844e42c5a116cabac671ff764b822ef
SSDeep: 12288:UY9Bg7Eg dZTzq/AtTz2GtfQ2LToPaDHyUaG5o2Fq W9oL2c:UEe7Qdk z2IQRPCn5oAXW9i2c
Size: 699904 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: BorlandDelphi30, BorlandDelphiv30, UPolyXv05_v6
Company: .
Created at: 1992-04-15 05:31:16
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

%original file name%.exe:1976

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

No files have been created.

Registry activity

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

The Trojan connects to the servers at the folowing location(s):

.idata

.rdata

P.reloc

P.rsrc

kernel32.dll

Windows

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

ssShift

htKeyword

EInvalidOperation

u%CNu

%s_%d

EInvalidGraphicOperation

%s%s (*.%s)|*.%2:s

%s*.%s

%s (%s)|%1:s|%s

USER32.DLL

windows

comctl32.dll

uxtheme.dll

Proportional

MAPI32.DLL

PasswordChar

OnKeyDown

OnKeyPress4

OnKeyUpX

OnKeyUp

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

TKeyEvent

TKeyPressEvent

HelpKeyword

crSQLWait

%s (%s)

Uh.OD

imm32.dll

OnExecute

AutoHotkeys$

AutoHotkeysl

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview

WindowStateP

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

User32.dll

getservbyport

WSAAsyncGetServByPort

WSAJoinLeaf

WS2_32.DLL

TIdSocketListWindows

TIdStackWindowsU

IdStackWindows

sfSysLogInternal

sfFTPDaemon

TIdSysLogMsgPart

%s %s %.2d:%.2d:%.2d %s

<%d>%s %s

[%d]:

OnExecuteMacro

Service %s

Topic %s

Q1%%s

!CvdBr.GL

Sý;jsK

Lzu.ErD

i\^%d

user32.dll

GetKeyboardType

advapi32.dll

RegOpenKeyExA

RegCloseKey

WinExec

GetCPInfo

version.dll

gdi32.dll

SetViewportOrgEx

UnhookWindowsHookEx

SetWindowsHookExA

SetKeyboardState

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextA

EnumWindows

EnumThreadWindows

ActivateKeyboardLayout

winspool.drv

comdlg32.dll

3 3$3(3,3034383<3@3\3|3

0!0	0^0

6)7-71787

0'1 1/13171;1@1

8 9/979<9

67

333333333333333333

33333833

3333339

3333333333333338

:*"*"$3338

3333333

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

"T!%C

.FIH2`

.NdD:

.At%J2

-%X9Sh_$YqTXB

.sG|F

J=Y%d

5.yxb

KWindows

UrlMon

IdUDPClient

IdUDPBase

Font.Charset

Font.Color

Font.Height

Font.Name

Font.Style

Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.

Host not found.-Invalid syslog message: incorrect PRI section1Invalid syslog message: incorrect PRI number "%s"0Invalid syslog message: incorrect timestamp "%s"FInvalid host name. A SYSLOG host name cannot contain any space ("%s") 

Protocol not supported.

Socket type not supported."Operation not supported on socket.

Protocol family not supported.0Address family not supported by protocol family.

%s is not a valid service.

Socket Error # %d

Operation would block.

Operation now in progress.

Operation already in progress.

Socket operation on non-socket.

No help keyword specified.

Set Size Exceeded.*Error on call Winsock2 library function %s&Error on loading Winsock2 library (%s)

Resolving hostname %s.

Connecting to %s.

Error setting %s.Count8Listbox (%s) style must be virtual in order to set Count"Unable to find a Table of Contents

No help found for %s#No context-sensitive help installed$No topic-based help system installed

Invalid clipboard format Clipboard does not support Icons

Cannot open clipboard Operation not supported on selected printer.There is no default printer currently selected/Menu '%s' is already being used by another form

(%dx%d)

7Invalid input value. Use escape key to abandon changes

Cannot drag a form"An error returned from DDE ($0%x)/DDE Error - conversation not established ($0%x)0Error occurred when DDE ran out of memory ($0%x)"Unable to connect DDE conversation

%s on %s@GroupIndex cannot be less than a previous menu item's GroupIndex5Cannot create form. No MDI forms are currently active*A control cannot have itself as its parent

Unsupported clipboard format

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window

Error reading %s%s%s: %s

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Invalid image!Cannot change the size of an icon$Unknown picture file extension (.%s)

*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s

Invalid stream format$''%s'' is not a valid component name

Invalid property value List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d)

Ancestor for '%s' not found

Cannot assign a %s to a %s

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Invalid variant operation%Invalid variant operation (%s%.8x)

%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

External exception %x

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

!'%s' is not a valid integer value

I/O error %d

Integer overflow Invalid floating point operation

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Trojan file.
   
3. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.