3 ms·

The malware now has 60/67 rating [1] on VT. Their analysis [2] is pretty good too. [1]: https://www.virustotal.com/gui/file/1679b086f649d92456b2f60028fe3be7169

• gruez 5y ago
  >Their analysis [2] is pretty good too. seriously? It's rather poor. >It was identified the malware is packed with Borland Delphi 6.0 - 7.0 as shown in the figure below Borland Delphi is a compiler. It's not a packer. Saying that it's "packed with Borland Delphi" makes as much sense as "it's packed with visual c++". >The strings of interest are as shown in the figure below But if it's packed (as previously suggested), then any strings of interest won't be visible. All we see is a bunch of strings related to dynamically linked libraries. That also doesn't tell you much, because you can dynamically load libraries so all the evil APIs you use don't show up on the list. The rest of the report seems to be reciting outputs from various reverse engineering tools, with little analysis added. The whole report gave the impression the author is a script kiddie.
  • caaqil 5y ago
    I mean sure, the analysis isn't thorough and has some oopsies, but from my POV it's not a report written by malware analysts or experts (rather, by someone you wouldn't expect to analyse it at all), so I'm not setting the bar too high.