Community Scans 10826b503ba6823f14893f06...

Community Scan Report

Flagged

10826b503ba6823f14893f0627823017ee1778881222ea9960a7e268739d6956

Detection Ratio

2 / 109 rules matched

233 ms scan time

2 rules matched

Matches rule Shellcode_NOP_Sled

4×

Matched Strings

$int3

4×

Offset (hex)	Offset (dec)	Length	Matched Data
0x8BBD	35773	4	\xCC\xCC\xCC\xCC
0x89F99	565145	4	\xCC\xCC\xCC\xCC
0x89F9A	565146	4	\xCC\xCC\xCC\xCC
0x89F9B	565147	4	\xCC\xCC\xCC\xCC

Matches rule inject_thread from malware by x0r

↳Code injection with CreateRemoteThread in a remote process

1×

Author

x0r

Matched Strings

$c1

1×

Offset (hex)	Offset (dec)	Length	Matched Data
0xB9B14	760596	11	OpenProcess

rule inject_thread
{ is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.
*/


rule inject_thread {
    meta:
        author = "x0r"
        description = "Code injection with CreateRemoteThread in a remote process"
	version = "0.1"
    strings:
        $c1 = "OpenProcess"
        $c2 = "VirtualAllocEx"
        $c3 = "NtWriteVirtualMemory"
        $c4 = "WriteProc}

Hashes

SHA-256

10826b503ba6823f14893f0627823017ee1778881222ea9960a7e268739d6956

SHA-1

ba1859d5d2f964f4ad2d3f6eeddb2f34b4699a44

MD5

add3ad031f6f9be619c766657933f049

SHA-512

9abffa53210168509d47ec7fcd2928e9c2c2547c45ffea7459f5d942cad31754d1afa73426119792141fa072db39435d1502a491821ddaec5f7fcd66e82ad275

File Properties

Detected Type Windows Executable (PE)

Magic PE32 executable for MS Windows 6.01 (GUI), Intel i386, 10 sections

Client MIME application/vnd.microsoft.portable-executable

Size 1.7 MB

Entropy 7.477 / 8.0

Times Analyzed 1

First Analyzed Aug 10, 2026 00:46

Last Analyzed Aug 10, 2026 00:46

Executable (PE) Details

Machine x86 (32-bit)

Bitness 32-bit (PE32)

Subsystem Windows GUI

Compiled 2021-06-03 08:09:11 UTC

Entry Point 0xB5EEC

Type EXE

Imphash 5a594319a0d69dbc452e748bcf05892e

Imported DLLs 7

Imported Functions 64

Exported Functions 3

Digitally signed

Section	Virtual Size	Raw Size	Entropy
.text	734748	735232	6.36
.itext	5768	6144	5.97
.data	14244	14336	5.04
.bss	28136	0	—
.idata	3894	4096	4.90
.didata	420	512	2.76
.edata	154	512	1.87
.tls	24	0	—
.rdata	93	512	1.38
.rsrc	69120	69120	3.71

Imported DLLs (7)

kernel32.dll — 25 function(s)

comctl32.dll — 1 function(s)

version.dll — 3 function(s)

user32.dll — 16 function(s)

oleaut32.dll — 11 function(s)

netapi32.dll — 2 function(s)

advapi32.dll — 6 function(s)

Extracted IOCs

16 indicator(s) found in file content

Domain

TMonitor.PWaitingThread TMonitor.TWaitingThread TMonitor.TSpinLock System.Byte System.Char System.Integer TInstItem.TBucketArray System.PPointer System.PInstItem System.Cardinal System.string System.Types TMultiWaitEvent.TWaiterFlag TMultiWaitEvent.TWaiterFlags TMultiWaitEvent.TMultiWaiter TMultiWaitEvent.TWaitInfo

Static Strings

500 strings · printable ASCII ≥ 6 chars

Offset (hex)	Offset (dec)	String
0x50	80	This program must be run under Win32
0x21F	543	`.itext
0x247	583	`.data
0x298	664	.idata
0x2C0	704	.didata
0x2E8	744	.edata
0x338	824	.rdata
0x35F	863	@.rsrc
0x406	1030	Boolean
0x426	1062	System
0x436	1078	AnsiChar
0x46A	1130	ShortInt
0x486	1158	SmallInt
0x4A2	1186	Integer
0x4EA	1258	Cardinal
0x506	1286	Pointer
0x53A	1338	UInt64
0x55A	1370	NativeInt
0x576	1398	NativeUInt
0x592	1426	Single
0x5A2	1442	Extended
0x5B6	1462	Double
0x5D6	1494	Currency
0x5EA	1514	ShortString
0x5FE	1534	PAnsiChar0
0x616	1558	PWideCharL
0x62E	1582	ByteBool
0x64F	1615	System
0x65E	1630	WordBool
0x67F	1663	System
0x68E	1678	LongBool
0x6AF	1711	System
0x6BE	1726	string
0x6CE	1742	WideString
0x6E2	1762	AnsiString
0x6F6	1782	Variant
0x706	1798	OleVariant
0x71A	1818	TClass
0x72E	1838	HRESULT
0x79A	1946	&op_Equality
0x7CE	1998	&op_Inequality
0x818	2072	Create
0x837	2103	BigEndian
0x84A	2122	Create
0x869	2153	AStartIndex
0x87C	2172	BigEndian
0x892	2194	PInterfaceEntry
0x8AE	2222	TInterfaceEntry
0x8E3	2275	VTable
0x8F5	2293	IOffset
0x908	2312	ImplGetter
0x91E	2334	PInterfaceTable4
0x93A	2362	TInterfaceTable
0x960	2400	EntryCount
0x976	2422	Entries
0x98A	2442	TMethod
0x9C8	2504	&op_Equality
0x9FC	2556	&op_Inequality
0xA32	2610	&op_GreaterThan
0xA69	2665	&op_GreaterThanOrEqual
0xAA7	2727	&op_LessThan
0xADB	2779	&op_LessThanOrEqual
0xC7F	3199	TObject&
0xC8D	3213	Create
0xCD7	3287	DisposeOf
0xD00	3328	InitInstance
0xD2B	3371	Instance
0xD3E	3390	CleanupInstance
0xD6D	3437	ClassType
0xD96	3478	ClassName
0xDCA	3530	ClassNameIs
0xE03	3587	ClassParent
0xE2E	3630	ClassInfo
0xE57	3671	InstanceSize
0xE83	3715	InheritsFrom
0xEAE	3758	AClass
0xEBF	3775	MethodAddress
0xEFA	3834	MethodAddress
0xF35	3893	MethodName
0xF5E	3934	Address
0xF7B	3963	QualifiedClassName
0xFB8	4024	FieldAddress
0xFF2	4082	FieldAddress
0x102C	4140	GetInterface
0x1072	4210	GetInterfaceEntry
0x10B0	4272	GetInterfaceTable
0x10E1	4321	UnitName
0x1114	4372	UnitScope
0x1148	4424	Equals
0x117B	4475	GetHashCode
0x11A6	4518	ToString
0x11D9	4569	SafeCallException
0x1209	4617	ExceptObject
0x121F	4639	ExceptAddr
0x1234	4660	AfterConstruction
0x1265	4709	BeforeDestruction
0x1296	4758	Dispatch
0x12BD	4797	Message
0x12CF	4815	DefaultHandler
0x12FC	4860	Message
0x130E	4878	NewInstance
0x1339	4921	FreeInstance
0x1365	4965	Destroy
0x138E	5006	TObjecth
0x13A0	5024	System
0x140F	5135	TCustomAttribute
0x1426	5158	TCustomAttribute
0x1441	5185	System
0x14AF	5295	WeakAttribute
0x14C2	5314	WeakAttribute
0x14DA	5338	System
0x1547	5447	UnsafeAttribute
0x155E	5470	UnsafeAttribute@!@
0x1578	5496	System
0x15E7	5607	VolatileAttribute
0x15FE	5630	VolatileAttribute
0x161A	5658	System
0x1697	5783	HPPGENAttribute5
0x16AD	5805	Create
0x16E2	5858	Create
0x1726	5926	HPPGENAttribute
0x1740	5952	System
0x1756	5974	PMonitorT$@
0x176A	5994	TMonitor.PWaitingThread
0x178E	6030	TMonitor.TWaitingThread
0x17CC	6092	Thread
0x17DE	6110	WaitEvent
0x17F6	6134	TMonitor.TSpinLock
0x185A	6234	TMonitor
0x1879	6265	FLockCount
0x1899	6297	FRecursionCount
0x18B4	6324	FOwningThread
0x18CD	6349	FLockEvent
0x18E3	6371	FSpinCount
0x18F9	6393	FWaitQueue
0x190F	6415	FQueueLock
0x1925	6437	SetSpinCount
0x193E	6462	AObject
0x194D	6477	ASpinCount
0x1973	6515	AObject
0x1996	6550	AObject
0x19A5	6565	Timeout
0x19C7	6599	AObject
0x19D8	6616	TryEnter
0x19ED	6637	AObject
0x1A0F	6671	AObject
0x1A1E	6686	Timeout
0x1A40	6720	AObject
0x1A5C	6748	Timeout
0x1A7F	6783	AObject
0x1A90	6800	PulseAll
0x1AA5	6821	AObject
0x1AB6	6838	IInterface
0x1AD6	6870	System
0x1AEA	6890	IEnumerable
0x1B0B	6923	System
0x1B1E	6942	IDispatch
0x1B3D	6973	System
0x1C06	7174	FRefCount
0x1C3A	7226	TInterfacedObject1
0x1C52	7250	AfterConstruction
0x1C83	7299	BeforeDestruction
0x1CB4	7348	NewInstance
0x1CDE	7390	TInterfacedObject
0x1CFA	7418	System
0x1D2A	7466	RefCount
0x1D3A	7482	PShortString
0x1D52	7506	UTF8String
0x1D66	7526	RawByteString
0x1D92	7570	PInt64
0x1DA6	7590	PExtended
0x1DBE	7614	PCurrency
0x1DD6	7638	PVariant
0x1DEA	7658	PPointer
0x1DFE	7678	TDateTime
0x1E22	7714	TVarArrayBound
0x1E47	7751	ElementCount
0x1E5F	7775	LowBound
0x1E76	7798	TVarArrayBoundArray
0x1EA2	7842	PVarArray
0x1EBA	7866	TVarArray
0x1EDA	7898	DimCount
0x1EFF	7935	ElementSize
0x1F16	7958	LockCount
0x1F3B	7995	Bounds
0x1F4E	8014	TVarRecord
0x1F6F	8047	PRecord
0x1F82	8066	RecInfo
0x1F96	8086	TVarData
0x1FC6	8134	Reserved1
0x1FDB	8155	Reserved2
0x1FF0	8176	Reserved3
0x2005	8197	VSmallInt
0x201A	8218	VInteger
0x202E	8238	VSingle
0x2041	8257	VDouble
0x2054	8276	VCurrency
0x207A	8314	VOleStr
0x208D	8333	VDispatch
0x20A2	8354	VError
0x20B4	8372	VBoolean
0x20C8	8392	VUnknown
0x20DC	8412	VShortInt
0x2113	8467	VLongWord
0x2128	8488	VUInt32
0x213B	8507	VInt64
0x214D	8525	VUInt64
0x2160	8544	VString
0x2183	8579	VArray
0x2195	8597	VPointer
0x21A9	8617	VUString
0x21BD	8637	VRecord
0x21D0	8656	VLongs
0x21E2	8674	VWords
0x21F4	8692	VBytes
0x2206	8710	RawData
0x221A	8730	TTypeKind
0x2231	8753	tkUnknown
0x223B	8763	tkInteger
0x2245	8773	tkChar
0x224C	8780	tkEnumeration
0x225A	8794	tkFloat
0x2262	8802	tkString
0x2271	8817	tkClass
0x2279	8825	tkMethod
0x2282	8834	tkWChar
0x228A	8842	tkLString
0x2294	8852	tkWString
0x229E	8862	tkVariant
0x22A8	8872	tkArray
0x22B0	8880	tkRecord
0x22B9	8889	tkInterface
0x22C5	8901	tkInt64
0x22CD	8909	tkDynArray
0x22D8	8920	tkUString
0x22E2	8930	tkClassRef
0x22ED	8941	tkPointer
0x22F7	8951	tkProcedure
0x2303	8963	tkMRecord
0x230D	8973	System
0x231E	8990	TVarRec
0x233C	9020	VInteger
0x2350	9040	VBoolean
0x2375	9077	VExtended
0x238A	9098	VString
0x239D	9117	VPointer
0x23B1	9137	VPChar
0x23C3	9155	VObject
0x23D6	9174	VClass
0x23E8	9192	VWideChar
0x23FD	9213	VPWideChar
0x2413	9235	VAnsiString
0x242A	9258	VCurrency
0x243F	9279	VVariant
0x2453	9299	VInterface
0x2469	9321	VWideString
0x2480	9344	VInt64
0x2492	9362	VUnicodeString
0x24AC	9388	_Reserved1
0x24D6	9430	TTypeTable
0x24FA	9466	PTypeTable
0x2512	9490	PPackageTypeInfo(1@
0x252E	9518	TPackageTypeInfo
0x2555	9557	TypeCount
0x256A	9578	TypeTable
0x257F	9599	UnitCount
0x2594	9620	UnitNames
0x25AA	9642	TArray<System.Byte>
0x25CE	9678	System
0x25E2	9698	TArray<System.Char>
0x2606	9734	SystemL
0x261A	9754	TArray<System.Integer>
0x2641	9793	System
0x2656	9814	PLibModuleh2@
0x266E	9838	TLibModule
0x269F	9887	Instance
0x26B3	9907	CodeInstance
0x26CB	9931	DataInstance
0x26E3	9955	ResInstance
0x26FA	9978	TypeInfo
0x270E	9998	Reserved
0x2722	10018	PResStringRec83@
0x273E	10046	TResStringRec
0x2762	10082	Module
0x2774	10100	Identifier
0x278A	10122	TFloatSpecial
0x27A5	10149	fsZero
0x27AC	10156	fsNZero
0x27B4	10164	fsDenormal
0x27BF	10175	fsNDenormal
0x27CB	10187	fsPositive
0x27D6	10198	fsNegative
0x27E7	10215	fsNInf
0x27F4	10228	System
0x2802	10242	TExtended80Rec
0x2827	10279	aExtended80
0x283E	10302	Exponent
0x2855	10325	Fraction
0x286C	10348	Mantissa
0x2883	10371	SpecialType
0x289D	10397	BuildUp
0x28B1	10417	SignFlag
0x28C1	10433	Mantissa
0x28D1	10449	Exponent
0x28E3	10467	&op_Explicit
0x2907	10503	&op_Explicit
0x292E	10542	PExceptionRecordD5@
0x294A	10570	TExceptionRecordP
0x2971	10609	ExceptionCode
0x298A	10634	ExceptionFlags
0x29A4	10660	ExceptionRecord
0x29BF	10687	ExceptionAddress
0x29DB	10715	NumberParameters
0x29F7	10743	ExceptionInformation
0x2A17	10775	ExceptAddr
0x2A2D	10797	ExceptObject
0x2C5C	11356	An unexpected memory leak has occurred.
0x2C88	11400	The unexpected small block leaks are:
0x2CB0	11440	The sizes of unexpected leaked medium and large blocks are:
0x2CF0	11504	bytes:
0x2CFC	11516	Unknown
0x2D04	11524	AnsiString
0x2D10	11536	UnicodeString
0x2D24	11556	Unexpected Memory Leak
0x4DB8	19896	~]x[[)
0x5260	21088	_^[YY]
0x58E8	22760	GetLogicalProcessorInformation
0x63C2	25538	YZXtm1
0x652A	25898	ZTUWVSPR
0x6D4E	27982	_^[YY]
0x71F5	29173	_^[YY]
0x76C3	30403	;Z]_^[
0x7BC7	31687	SVWRPj
0x7C62	31842	Z_^[XX
0x7E0E	32270	tWI\|TVS
0x7EC2	32450	tdI\|aVS
0x8949	35145	_^[YY]
0x8D0D	36109	$Z]_^[
0x9424	37924	zh-TW,zh-Hant,zh
0x9438	37944	es-ES_tradnl
0x9448	37960	nb-NO,nb,no
0x9454	37972	tg-Cyrl-TJ
0x9460	37984	az-Latn-AZ
0x946C	37996	uz-Latn-UZ
0x9478	38008	mn-MN,mn-Cyrl,mn
0x948C	38028	iu-Cans-CA
0x9498	38040	ha-Latn-NG
0x94A4	38052	qps-ploc,en
0x94B0	38064	qps-ploca,ja
0x94C0	38080	zh-CN,zh-Hans,zh
0x94D4	38100	nn-NO,nn,no
0x94E0	38112	sr-Latn-CS
0x94EC	38124	az-Cyrl-AZ
0x94F8	38136	dsb-DE,dsb,hsb
0x9508	38152	uz-Cyrl-UZ
0x9514	38164	mn-Mong-CN
0x9520	38176	iu-Latn-CA
0x952C	38188	tzm-Latn-DZ
0x9538	38200	qps-plocm,ar
0x9548	38216	zh-HK,zh-Hant,zh
0x955C	38236	sr-Cyrl-CS
0x9568	38248	zh-SG,zh-Hans,zh
0x957C	38268	smj-NO,smj,se
0x958C	38284	zh-MO,zh-Hant,zh
0x95A0	38304	bs-Latn-BA
0x95AC	38316	smj-SE,smj,se
0x95BC	38332	sr-Latn-BA
0x95C8	38344	sma-NO,sma,se
0x95D8	38360	sr-Cyrl-BA
0x95E4	38372	sma-SE,sma,se
0x95F4	38388	bs-Cyrl-BA
0x9600	38400	sms-FI,sms,se
0x9610	38416	sr-Latn-RS
0x961C	38428	smn-FI,smn,se
0x962C	38444	sr-Cyrl-RS
0x9638	38456	sr-Latn-ME
0x9644	38468	sr-Cyrl-ME
0x96D0	38608	GetThreadPreferredUILanguages
0x970C	38668	SetThreadPreferredUILanguages
0x972C	38700	GetThreadUILanguage
0x982D	38957	,tdBHu
0x9F04	40708	GetLongPathNameW
0xA7DF	42975	_^[YY]
0xA902	43266	PInstItemD
0xA91A	43290	TInstItem.TBucketArray\|
0xA94A	43338	TInstItem
0xA97A	43386	FInstance
0xA9A0	43424	FBuckets
0xA9B4	43444	FMethodBuckets
0xA9CE	43470	Create
0xA9E3	43491	Destroy
0xAA0C	43532	RegisterWeakRef
0xAA28	43560	Address
0xAA39	43577	UnregisterWeakRef
0xAA57	43607	Address
0xAA68	43624	RegisterWeakMethodRef
0xAA8A	43658	Address
0xAA9B	43675	UnregisterWeakMethodRef
0xAABF	43711	Address
0xAAD2	43730	TInstBucket
0xAB0D	43789	FCount
0xAB1F	43807	FInstItems
0xAB35	43829	Initialize
0xAB4E	43854	Finalize
0xAB78	43896	Unlock
0xAB8D	43917	AddInstItem
0xABA5	43941	AIndex
0xABC2	43970	FindInstItem
0xABDB	43995	AInstance
0xABEC	44012	AIndex
0xABFC	44028	RemoveInstItem
0xAC17	44055	AInstance
0xAC2A	44074	:TInstHashMap.:1<
0xAC56	44118	TInstHashMapX
0xAC81	44161	FFreeInstItems
0xACA5	44197	FTagCounter
0xACC6	44230	FFreeCount
0xACDC	44252	FInitLock
0xACF1	44273	FBuckets
0xAD05	44293	FInitialized
0xAD1D	44317	Destroy
0xAD31	44337	Instance
0xAD43	44355	Initialize
0xAD5C	44380	Finalize
0xAD73	44403	RegisterWeakRef
0xAD8F	44431	Address
0xAD9E	44446	Instance
0xADB0	44464	UnregisterWeakRef
0xADCE	44494	Address
0xADDD	44509	Instance
0xADEF	44527	RegisterWeakMethodRef
0xAE11	44561	Address
0xAE20	44576	Instance
0xAE32	44594	UnregisterWeakMethodRef
0xAE56	44630	Address
0xAE65	44645	Instance
0xAE77	44663	IsRegistered
0xAE90	44688	Instance
0xAEA2	44706	TArray<System.PPointer>
0xAECA	44746	System
0xAEDE	44766	TArray<System.PInstItem>
0xAF07	44807	System
0xB1DA	45530	_^[YY]
0xCBF6	52214	TArray<System.Cardinal>
0xCC1E	52254	System
0xCC32	52274	TArray<System.string>
0xCC58	52312	System
0xCC6A	52330	TDuplicates
0xCC83	52355	dupIgnore
0xCC8D	52365	dupAccept
0xCC97	52375	dupError
0xCCA0	52384	System.Types
0xCCB6	52406	TDirection
0xCCCE	52430	FromBeginning
0xCCDC	52444	FromEnd
0xCCE4	52452	System.Types
0xCCFA	52474	TWaitResult
0xCD13	52499	wrSignaled
0xCD1E	52510	wrTimeout
0xCD28	52520	wrAbandoned
0xCD34	52532	wrError
0xCD3C	52540	wrIOCompletion
0xCD4B	52555	System.Types
0xCD62	52578	TMultiWaitEvent.TWaiterFlag
0xCD8B	52619	Waiting
0xCD93	52627	WaitAll
0xCD9B	52635	System.Types
0xCDB2	52658	TMultiWaitEvent.TWaiterFlags
0xCDDD	52701	:TMultiWaitEvent.TMultiWaiter.:1
0xCE15	52757	FiredEvent
0xCE2B	52779	EventCount
0xCEB7	52919	FRefCount
0xCECC	52940	FFlags
0xCEDE	52958	FStatus
0xCEFE	52990	TMultiWaitEvent.TMultiWaiter&
0xCF21	53025	Create
0xCF47	53063	Destroy
0xCF6E	53102	TMultiWaitEvent.TMultiWaiter
0xCF95	53141	System.Types
0xCFB2	53170	TMultiWaitEvent.TWaitInfo
0xCFE2	53218	FWaiter
0xCFF5	53237	FIndex
0xD0DF	53471	TMultiWaitEvent
0xD0F5	53493	Create
0xD10D	53517	Destroy
0xD134	53556	WaitFor
0xD15A	53594	Timeout
0xD16C	53612	SetEvent
0xD194	53652	ResetEvent
0xD1BE	53694	WaitForAll
0xD1D9	53721	Events
0xD1E9	53737	Timeout
0xD1FB	53755	WaitForAny
0xD216	53782	Events
0xD226	53798	Timeout
0xD238	53816	WaitForAny
0xD253	53843	Events
0xD272	53874	Timeout
0xD284	53892	WaitForAny
0xD29F	53919	Events