YRP/PseudoSigner_02_BJFNT_11b_Anorganix YRP/BJFnt_v11b_MARQUiS YRP/PseudoSigner_02_BJFNT_11b YRP/BJFntv11b YRP/PseudoSigner02BJFNT11bAnorganix YRP/PEArmor07600765hying YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/maldoc_getEIP_method_1 YRP/domain YRP/contentis_base64

YRP/PseudoSigner_02_BJFNT_11b_Anorganix YRP/BJFnt_v11b_MARQUiS YRP/PseudoSigner_02_BJFNT_11b YRP/BJFntv11b YRP/PseudoSigner02BJFNT11bAnorganix YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/VM_Generic_Detection YRP/Dropper_Strings YRP/ThreadControl__Context YRP/inject_thread YRP/create_service YRP/network_tcp_socket YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/rat_rdp YRP/rat_webcam YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/win_hook YRP/BASE64_table YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API

YRP/PseudoSigner_02_BJFNT_11b_Anorganix YRP/BJFnt_v11b_MARQUiS YRP/PseudoSigner_02_BJFNT_11b YRP/Borland YRP/BJFntv11b YRP/MaskPEV20yzkzero YRP/PseudoSigner02BJFNT11bAnorganix YRP/IsPE32 YRP/IsWindowsGUI YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/Dropper_Strings YRP/Misc_Suspicious_Strings YRP/create_service YRP/network_tcp_socket YRP/network_dns YRP/escalate_priv YRP/keylogger YRP/sniff_audio YRP/spreading_share YRP/rat_webcam YRP/check_patchlevel YRP/win_registry YRP/win_token YRP/win_files_operation YRP/Big_Numbers1 YRP/CRC32_poly_Constant YRP/CRC32_table YRP/FGint_MontgomeryModExp YRP/FGint_DivMod YRP/FGint_FGIntDestroy YRP/FGint_Base10StringToGInt YRP/FGint_ConvertBase256to64 YRP/FGint_RSAEncrypt YRP/FGint_RsaDecrypt YRP/Delphi_Random YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Delphi_DecodeDate YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/suspicious_packer_section

YRP/PseudoSigner_02_BJFNT_11b_Anorganix YRP/BJFnt_v11b_MARQUiS YRP/PseudoSigner_02_BJFNT_11b YRP/Borland YRP/BJFntv11b YRP/MaskPEV20yzkzero YRP/PseudoSigner02BJFNT11bAnorganix YRP/IsPE32 YRP/IsWindowsGUI YRP/domain YRP/IP YRP/contentis_base64 YRP/Browsers YRP/VM_Generic_Detection YRP/Dropper_Strings YRP/ThreadControl__Context YRP/inject_thread YRP/create_service YRP/network_udp_sock YRP/network_tcp_listen YRP/network_dropper YRP/network_tcp_socket YRP/network_dns YRP/network_ssl YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/sniff_audio YRP/spreading_share YRP/rat_webcam YRP/check_patchlevel YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/win_hook YRP/CRC32_poly_Constant YRP/CRC32_table YRP/BASE64_table YRP/Delphi_FormShow YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Delphi_DecodeDate YRP/Str_Win32_Winsock2_Library YRP/CookieTools YRP/suspicious_packer_section

YRP/_PseudoSigner_02_BJFNT_11b YRP/PseudoSigner_02_BJFNT_11b_Anorganix YRP/BJFnt_v11b_MARQUiS YRP/PseudoSigner_02_BJFNT_11b YRP/BJFntv11b YRP/PseudoSigner02BJFNT11bAnorganix YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/ExportTableIsBad YRP/domain YRP/contentis_base64 YRP/Browsers YRP/Antivirus YRP/VM_Generic_Detection YRP/VirtualPC_Detection YRP/Dropper_Strings YRP/Misc_Suspicious_Strings YRP/vmdetect YRP/Check_OutputDebugStringA_iat YRP/anti_dbg YRP/antivm_vmware YRP/network_tcp_socket YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/sniff_audio YRP/rat_rdp YRP/rat_webcam YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/BASE64_table YRP/Typical_Malware_String_Transforms YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API FlorianRoth/Typical_Malware_String_Transforms FlorianRoth/GhostDragon_Gh0stRAT

YRP/PseudoSigner_02_BJFNT_11b_Anorganix YRP/BJFnt_v11b_MARQUiS YRP/PseudoSigner_02_BJFNT_11b YRP/Borland YRP/BJFntv11b YRP/PseudoSigner02BJFNT11bAnorganix YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/domain YRP/IP YRP/contentis_base64 YRP/Browsers YRP/Dropper_Strings YRP/Misc_Suspicious_Strings YRP/ThreadControl__Context YRP/Check_OutputDebugStringA_iat YRP/anti_dbg YRP/inject_thread YRP/create_service YRP/network_udp_sock YRP/network_tcp_listen YRP/network_tcp_socket YRP/network_dns YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/sniff_audio YRP/spreading_share YRP/rat_webcam YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/win_hook YRP/Delphi_Random YRP/Delphi_FormShow YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Delphi_DecodeDate YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API YRP/CookieTools

YRP/PseudoSigner_02_BJFNT_11b_Anorganix YRP/BJFnt_v11b_MARQUiS YRP/PseudoSigner_02_BJFNT_11b YRP/BJFntv11b YRP/PseudoSigner02BJFNT11bAnorganix YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/suspicious_packer_section

YRP/PseudoSigner_02_BJFNT_11b_Anorganix YRP/BJFnt_v11b_MARQUiS YRP/PseudoSigner_02_BJFNT_11b YRP/Borland YRP/BJFntv11b YRP/UPXProtectorv10x2 YRP/PseudoSigner02BJFNT11bAnorganix YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/domain YRP/contentis_base64 YRP/screenshot YRP/rat_webcam YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/UPX YRP/suspicious_packer_section

YRP/PseudoSigner_02_BJFNT_11b_Anorganix YRP/BJFnt_v11b_MARQUiS YRP/PseudoSigner_02_BJFNT_11b YRP/BJFntv11b YRP/PseudoSigner02BJFNT11bAnorganix YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/maldoc_getEIP_method_1 YRP/domain YRP/contentis_base64 YRP/keylogger YRP/rat_webcam YRP/win_registry YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/suspicious_packer_section