unattributed: 73d7c8e5 — Delphi VCL purchase-order masquerade, no observable payload

Executive Summary

A ~1 MB Delphi VCL PE32 (PO-0028201.PDF.exe) distributed with a purchase-order filename masquerade. Static analysis reveals no network C2 indicators, no credential-theft APIs, no persistence mechanisms, and no anti-analysis countermeasures. The import table is dominated by VCL GUI runtime (user32, gdi32, comctl32) with only a handful of generic Win32 APIs (CreateFileA, WriteFile, VirtualAlloc, RegQueryValueExA). Three small RT_RCDATA resources (16–3989 bytes) are present but do not constitute a large embedded payload. Without dynamic execution, this sample cannot be confidently ascribed to any known crimeware family; it may be a benign application repackaged for social engineering, or a minimal stub whose threat logic is entirely runtime-resolved.

What It Is

• File: PO-0028201.PDF.exe (1008128 bytes) ^[metadata.json:1-10]
• Format: PE32 executable (GUI) Intel 80386, for MS Windows, 9 sections ^[file.txt:1]
• Compiler: Borland Delphi — Ghidra reports borlanddelphi / borland:pascal; rabin2 reports lang: c (common mis-classification for Delphi) ^[rabin2-info.txt:17] ^[ghidra metadata]
• Timestamp: Borland default 1992-06-19 22:22:17 — nuisance/fabricated, not compile-time ^[rabin2-info.txt:11] ^[pefile.txt:38]
• Signed: No ^[rabin2-info.txt:27]
• Packer / crypter: None observed. Standard VCL sections: .text, .itext, .data, .bss, .idata, .tls, .rdata, .reloc, .rsrc ^[pefile sections dump]
• YARA: Only generic PE_File_Generic rule hit ^[yara.txt:1]
• CAPE: Not detonated (no Windows guest available); dynamic-analysis.md is empty.

How It Works

Static analysis does not reveal a clear threat mechanism. The binary is a conventional Delphi VCL GUI application:

• Extensive VCL form/control class strings (TButtonActionLink, TButtonControl, TCustomForm, TFormBorderStyle, TFormStyle, TMouseButton, odComboBoxEdit, poMainFormCenter, dmMainForm) ^[strings.txt:1331-1341]
• FastMM memory manager marker (FastMM Borland Edition) ^[strings.txt:1]
• RTL units (SysInit, TUnitHashArray) and compiler artifact (Rebuild) ^[strings.txt:110,4694,760]
• Unicode UI strings: taskband, taskbar, DLGTEMPLATE ^[strings.txt Unicode grep]

The import table is overwhelmingly VCL/GUI-oriented:

• user32.dll — 100+ windowing/message/scroll/menu APIs (CreateWindowExA, ShowWindow, MessageBoxA, SendMessageA, etc.)
• gdi32.dll — 50+ drawing/bitmask APIs (BitBlt, CreateCompatibleDC, SelectObject, etc.)
• comctl32.dll — ImageList common controls
• ole32.dll — CoInitialize / CoUninitialize
• oleaut32.dll — SafeArray / Variant COM helpers
• version.dll — GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA (but no RT_VERSION resource present)
• advapi32.dll — RegQueryValueExA, RegOpenKeyExA, RegFlushKey, RegCloseKey (read-only / flush, no write/persistence)
• kernel32.dll — Sleep (only kernel32 import)

From strings, the only "suspicious" API names present are: VirtualAlloc, LoadLibraryExA, LoadLibraryA, GetProcAddress, WriteFile, CreateFileA, RegQueryValueExA ^[strings.txt grep]. These are insufficient to infer a specific payload without decompilation of the entry point.

PE resources include standard VCL assets: RT_CURSOR (7), RT_BITMAP (10), RT_ICON (4), RT_DIALOG (2), RT_STRING (12 blocks), RT_RCDATA (3 blobs: 16 B, 792 B, 3989 B), RT_GROUP_CURSOR (7), RT_GROUP_ICON (1). The RT_RCDATA blobs are too small to be a compressed binary payload; they likely hold form data or localized strings. ^[pefile resource dump]

No network APIs (WinHTTP, WinInet, WS2_32, UrlMon imports other than the strings UrlMon in strings.txt but not in IAT) are imported. No Crypt32.dll. No certificate APIs. No process-injection APIs (CreateRemoteThread, NtWriteVirtualMemory, etc.).

Decompiled Behavior

Ghidra analysis (borlanddelphi compiler ID) was imported successfully but function-level decompilation was not completed in this session due to the absence of defined functions in the auto-analysis pass — a common issue with Delphi binaries where the entry point is a compiler-generated RTL initializer rather than user code. The radare2 entry point at 0x00460210 is a large RTL/VCL initialization routine with no obvious malicious control flow in the first 32 KB of pseudocode. No XOR loops, no API hash resolution, no obfuscated string decoders, and no suspicious heap allocations were observed in the surface decompilation.

C2 Infrastructure

• None observable statically.
• No hardcoded IPs, domains, URLs, mutex names, named pipes, or registry persistence keys.
• The string UrlMon appears in the string table but UrlMon.dll is not in the import table, and no URL strings were recovered via FLOSS (FLOSS run failed with argument-parsing error) ^[floss.txt:1-6].
• C2 verdict: Runtime-resolved or absent. If this binary is malicious, its C2 is either inside the tiny RT_RCDATA blobs (unlikely at 3989 bytes max) or fetched via runtime API resolution not visible in static strings.

Interesting Tidbits

• Purchase-order masquerade: Filename PO-0028201.PDF.exe follows the PO-<number>.PDF.exe pattern documented at social-engineering-purchase-order-masquerade. ^[metadata.json:4]
• Empty version info: GetFileVersionInfoSizeA / GetFileVersionInfoA are imported, but RT_VERSION resource is absent — a common Delphi quirk where the version-info unit is linked but no version block is authored. ^[pefile resource dump]
• Borland 1992 timestamp: Same nuisance timestamp seen in euone, nfedigitalcom, and other Delphi samples in this corpus. Not a reliable compile-age indicator. ^[rabin2-info.txt:11]
• No capa results: capa run failed because signature files were not installed, so no capability ATT&CK mapping is available for this sample. ^[capa.txt:1-6]
• FLOSS failure: The automated FLOSS run errored out with argument-parsing issues, so no decoded/stacked strings were recovered. Manual strings review (4780 lines) found nothing suspicious. ^[floss.txt:1-6]
• Taskbar/taskband strings: Unicode strings suggest a windowed application that interacts with the Windows taskbar — consistent with a VCL form that minimizes to the taskbar or uses the TaskDialog API. ^[strings.txt Unicode grep]

How To Mess With It (Homelab Replication)

1. Toolchain: Install Delphi Community Edition (Embarcadero) or Lazarus/Free Pascal.
2. Create a VCL Forms Application: Add a TForm, TButton, TEdit, TLabel. Set FormStyle to fsNormal and BorderStyle to bsDialog.
3. Add a TOpenDialog / TSaveDialog to generate CreateFileA / WriteFile imports when compiling.
4. Add registry read: Drop a TRegistry component reading HKEY_CURRENT_USER\Software\Borland\Delphi\RTL to generate RegQueryValueExA.
5. Compile with default settings (no packer, no obfuscation). Observe the resulting PE is ~600 KB–1.2 MB depending on VCL linked units.
6. Rename output to PO-XXXXX.PDF.exe to replicate the masquerade.

Verification step: Run file <output.exe> and confirm PE32 executable (GUI) Intel 80386. Check strings for FastMM Borland Edition, TForm, SysInit. Compare import table to this sample — should be dominated by user32/gdi32/comctl32.

Deployable Signatures

YARA Rule

rule Delphi_VCL_PurchaseOrder_Masquerade_Thin
{
    meta:
        description = "Delphi VCL PE with purchase-order filename masquerade and minimal suspicious imports"
        author = "malware-corpus-auto"
        date = "2026-07-06"
        hash = "73d7c8e50ff4a34450c12fd28347b064d2d8147a92602c0ae101f5d9cbba639b"
    strings:
        $delphi1 = "FastMM Borland Edition" ascii
        $delphi2 = "TCustomForm" ascii
        $delphi3 = "SysInit" ascii
        $po1 = /PO[-_]\d{4,8}\.PDF\.exe/i
        $po2 = /Purchase[\s_-]?Order.*\.exe/i
    condition:
        uint16(0) == 0x5A4D and
        pe.number_of_sections >= 8 and
        ($delphi1 or $delphi2 or $delphi3) and
        pe.imports("user32.dll", "CreateWindowExA") and
        pe.imports("gdi32.dll", "BitBlt") and
        (filesize > 900KB and filesize < 1.5MB) and
        filesize < 2MB and
        any of ($po*)
}

Behavioral Fingerprint Statement

This binary is a ~1 MB Delphi VCL GUI application with no packed sections, no network imports, no cryptographic imports, and no persistence registry writes. Its only suspicious surface indicators are the PO-*.PDF.exe masquerade filename and the presence of generic file I/O APIs (CreateFileA, WriteFile) alongside VCL windowing imports. If executed in a sandbox, monitor for: (a) unexpected file writes outside the temp directory, (b) registry writes to Run keys (none observed statically), (c) network connections (none observed statically), and (d) process creation or injection (none observed statically).

IOC List

Detection Signatures

• capa: Failed (signature path missing). No ATT&CK mapping available for this sample. ^[capa.txt:1-6]
• YARA: Generic PE_File_Generic hit only. No family-specific rules matched. ^[yara.txt:1]
• Manual ATT&CK assessment (static-only, low confidence):
  • T1204.002 — User Execution: Malicious File (purchase-order masquerade)
  • T1036.007 — Masquerading: Double File Extension (.PDF.exe)
  • No further TTPs observable without dynamic execution.

References

• SHA-256: 73d7c8e50ff4a34450c12fd28347b064d2d8147a92602c0ae101f5d9cbba639b
• Source: OpenCTI / MalwareBazaar
• Related wiki pages:
  • unattributed — umbrella entity for singletons
  • social-engineering-purchase-order-masquerade — filename masquerade pattern
  • delphi-vcl-certificate-harvesting — related Delphi VCL technique (different family)
  • euone — Delphi VCL installer with RCData payload (different family)
  • nfedigitalcom — Delphi certificate-harvesting family (different family)
  • brooter — Delphi brute-forcer family (different family)

Provenance

Analysis derived from static triage artifacts in raw/analyses/73d7c8e50ff4a34450c12fd28347b064d2d8147a92602c0ae101f5d9cbba639b/:

• file.txt, metadata.json, pefile.txt, rabin2-info.txt, strings.txt, ssdeep.txt, tlsh.txt, yara.txt, capa.txt, floss.txt, binwalk.txt, dynamic-analysis.md
• Ghidra import confirmed compiler ID borlanddelphi on x86:LE:32.
• radare2 session: aaa analysis at entrypoint 0x00460210.
• No CAPE detonation available (no Windows guest). All behavior claims are static-only and explicitly marked as such.

Report generated 2026-07-06. Static-only analysis; dynamic behavior not observed.