brooter: b04aa5d0 — Russian Delphi VCL brute-forcer with ICQ contact, SALES_INQUIRY.pdf.exe lure

Executive Summary

A 1.65 MB PE32 GUI binary built in Delphi 7/2006-era VCL, presenting as [Brooter] ICQ: 322322032. This is a Russian-language account brute-forcing / credential-stuffing tool, not a trojan, RAT, or infostealer. The threat is purely in the social-engineering distribution vector: the file was submitted to MalwareBazaar as SALES_INQUIRY.pdf.exe, exploiting Windows' hidden-extension default. Static-only analysis (no CAPE machine available for PE32).

What It Is

Tool type: Account brute-forcer / credential-stuffing utility with dictionary-attack and list-attack modes, threaded execution, and HTTP connectivity via WinInet/UrlMon.

Language / framework: Delphi Object Pascal with VCL (Visual Component Library). Full VCL RTL present including FastMM memory manager, standard Delphi exception classes, and TComponent/TForm GUI framework. ^[strings.txt:1-400]

Build / RE

Toolchain

• Compiler: Delphi 7-era or Delphi 2006/2007 (Borland/CodeGear). The presence of FastMM Borland Edition (2004–2005 Pierre le Riche) and the SOFTWARE\Borland\Delphi\RTL registry path points to pre-RAD Studio 2009. ^[strings.txt:20] ^[strings.txt:30]
• Linker version: 2.25 (MajorLinkerVersion=0x2, MinorLinkerVersion=0x19) ^[exiftool.json]
• Memory manager: FastMM4, Borland Edition ^[strings.txt:20]
• Subsystem: Windows GUI ^[file.txt]

Sections (9)

^[pefile.txt:76-256]

Resources

The .rsrc section is large (1.15 MB) but entirely legitimate VCL resources, not an encrypted payload:

• RT_ICON (7 entries × 308 bytes) — standard Delphi icon suite ^[resources dump]
• RT_BITMAP (11 entries) — includes one 883 KB DIB bitmap (BITMAPINFOHEADER=40, 800×368×24bpp). Verified as a real bitmap, not steganography. Entropy 5.65. ^[resources dump]
• RT_GROUP_ICON (6 entries, 2,440–38,056 bytes) — icon group descriptors ^[resources dump]
• RT_RCDATA (14 entries) — includes a 144 KB DFM form resource (TfrmBroot) and 16-byte cursor hotspot data ^[resources dump]
• RT_STRING (2 entries × 82 bytes) ^[resources dump]
• RT_CURSOR (3 entries) ^[resources dump]
• RT_MANIFEST (1 entry, 581 bytes) — standard Delphi XPManifest referencing Microsoft.Windows.Common-Controls 6.0.0.0 ^[strings.txt:3825-3843]

No VS_VERSIONINFO resource is present — the Properties dialog would show no CompanyName, FileDescription, or ProductVersion. ^[pe resources scan]

Imports

Standard Delphi VCL import surface — no suspicious API injection, no process hollowing primitives, no crypto APIs beyond what the md5hash unit likely implements internally:

• kernel32.dll — standard runtime (VirtualAlloc, CreateThread, Sleep, GetTickCount, etc.)
• user32.dll — full Win32 GUI surface (CreateWindowEx, SendMessage, MessageBox, etc.)
• gdi32.dll — graphics primitives
• ole32.dll / oleaut32.dll — COM/OLE automation (VCL requirement)
• advapi32.dll — RegQueryValueEx, RegOpenKeyEx, RegCloseKey
• version.dll — GetFileVersionInfo (VCL shell integration)
• comctl32.dll — ImageList, Common Controls
• comdlg32.dll — GetOpenFileName (file dialog)
• shell32.dll — Shell_NotifyIcon (tray icon)

^[r2 imports]

Anti-analysis

None. No debugger detection, no VM checks, no timing loops, no encrypted strings. This is a plain Delphi GUI application compiled without obfuscation. The only "evasion" is the social-engineering filename.

Code Quality

Amateur / commodity crimeware. Hardcoded ICQ contact (322322032), Russian-language UI strings stored in plaintext DFM resources, no attempt to hide functionality. Uses standard VCL components (TButton, TEdit, TRadioButton, TGroupBox, TLabeledEdit, TUpDown, TStaticText, TTrayIcon, TPopupMenu).

Deploy / ATT&CK

Distribution

Social engineering via double-extension masquerade. The filename SALES_INQUIRY.pdf.exe exploits Windows Explorer's default "Hide extensions for known file types" setting, presenting as a PDF while executing a PE. ^[triage.json]

Tool Functionality (static inference)

No CAPE detonation available (no Windows guest). Static analysis reveals an account brute-forcing utility with the following controls:

Attack modes:

• Dictionary attack (Атака по словарю — "attack by dictionary"): Loads a wordlist file, tests passwords against a target login.
• List attack (Атака по списку — "attack by list"): Loads a combo list (login:password pairs).

Threading: Configurable thread count via TUpDown control, suggesting parallel HTTP(S) requests to target authentication endpoints. ^[strings.txt:3740-3769]

HTTP capability: Imports WinInet and UrlMon units (standard Delphi HTTP client wrappers), indicating the tool makes web requests to target login forms. No hardcoded URLs or IPs found statically. ^[strings.txt:3445] ^[strings.txt:3444]

Hashing: Custom md5hash unit present, likely for MD5-based password hashing or response verification. ^[strings.txt:3470]

Compression: ZLibConst unit present, possibly for decompressing HTTP responses or compressed wordlists. ^[strings.txt:3471]

Persistence / C2 / Exfiltration

None observed. This is a standalone attack tool, not a persistent implant. No registry keys, no scheduled tasks, no startup entries. No C2 infrastructure. No data exfiltration from the victim host. The "malicious" behavior is the unauthorized credential-stuffing against third-party services, not host compromise.

Attribution

• Language: Russian (CP1251-encoded UI strings in DFM resource)
• Contact: ICQ UIN 322322032 — classic Russian-speaking underground contact method
• Tool name: "Brooter" (Russian slang for brute-forcer, from "brute force" → "брут" → "брутер")
• Era: Likely mid-to-late 2000s or early 2010s based on ICQ contact, Delphi 7-era build, and FastMM4 version
• Distribution: Repackaged under a business-document lure for social-engineering distribution. The original tool was likely distributed on Russian-language cracking/hacking forums and later repurposed by a different actor with the SALES_INQUIRY.pdf.exe filename.

Interesting Tidbits

• No VS_VERSIONINFO: Empty version-info resource means the Properties dialog shows nothing — a small anti-triage signal, though more likely just default Delphi build settings.
• Fake timestamp: 1992-06-19 is a standard Delphi placeholder, not a real build date. ^[pefile.txt:34]
• Large .rsrc section: The 883 KB bitmap is unusually large for a tool icon but is a legitimate DIB (800×368×24bpp). It may be a splash screen or background image for the main form. No steganography detected.
• evalcomp unit: An unusual unit name — possibly "expression compiler" or a custom evaluation component. Could be used for generating password variations or evaluating server responses.
• No network IOCs: Unlike most malware in this corpus, this sample has zero hardcoded network indicators. Target URLs, proxies, and configurations are loaded at runtime from user input or external files.
• Tray icon behavior: The TTrayIcon + TPopupMenu pattern allows the tool to hide to the system tray while running brute-force threads in the background — a convenience feature for the attacker, not evasion.

How To Mess With It (Homelab Replication)

Build a comparable Delphi GUI brute-forcer

1. Install Delphi 7 or Lazarus/Free Pascal (modern open-source equivalent).
2. Create a new VCL Forms Application.
3. Drop components: TEdit (login), TLabeledEdit (dictionary path), TUpDown + TEdit (thread count), TRadioGroup (attack mode), TButton (start/stop), TStaticText (counters in clGreen/clMaroon/clNavy).
4. Add TTrayIcon + TPopupMenu for system tray minimization.
5. Implement threading with TThread descendants making HTTP POST requests via TIdHTTP (Indy) or WinInet API.
6. Add MD5 hashing for password transforms ( Indy IdHashMessageDigest5 or custom implementation).
7. Add zlib decompression for compressed wordlists.
8. Compile with default settings — no packing needed.
9. Verification: Compare the resulting PE's section layout, import surface, and string artifacts to this sample. Should show .itext, .bss, .tls, .rdata sections and identical VCL RTL strings.

What you'll learn

How a commodity credential-stuffing tool looks in static analysis — and why the absence of malicious APIs doesn't mean the file is benign. The threat is in the use case and distribution method, not the binary's capabilities.

Deployable Signatures

YARA Rule

rule DELPHI_Brooter_BruteForcer {
    meta:
        description = "Russian Delphi VCL brute-forcer tool 'Brooter' with ICQ contact"
        author = "PacketPursuit"
        date = "2026-06-28"
        hash = "b04aa5d0ede5653b20f6db6d6df0020e396dfe8688f2c4712cff6dccce2002d4"
    strings:
        $a1 = "FastMM Borland Edition" ascii
        $a2 = "SOFTWARE\\Borland\\Delphi\\RTL" ascii
        $a3 = "DelphiApplication" ascii
        $a4 = "[Brooter] ICQ: 322322032" ascii wide
        $a5 = "TfrmBroot" ascii
        $a6 = "btnStartClick" ascii
        $a7 = "btnStopClick" ascii
        $a8 = "txtDict" ascii
        $a9 = "txtList" ascii
        $a10 = "cntGood" ascii
        $a11 = "cntBad" ascii
        $a12 = "cntCheck" ascii
        $a13 = "md5hash" ascii
        $a14 = "ZLibConst" ascii
        $a15 = "evalcomp" ascii
        $b1 = "Загрузка словаря" wide
        $b2 = "Атака по словарю" wide
        $b3 = "Атака по списку" wide
        $b4 = "Потоки:" wide
    condition:
        uint16(0) == 0x5A4D and
        filesize < 3MB and
        8 of ($a*) and
        2 of ($b*)
}

Sigma Rule

title: Brooter Delphi Brute-Forcer Execution
description: Detects execution of the Russian Brooter brute-forcing tool distributed as SALES_INQUIRY.pdf.exe
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    - Image|endswith: '\\SALES_INQUIRY.pdf.exe'
    - CommandLine|contains: 'SALES_INQUIRY.pdf'
    - OriginalFileName: 'SALES_INQUIRY.pdf.exe'
  condition: selection
falsepositives:
  - None expected — this is a specific filename for a known tool
level: high

IOC List

Behavioral Fingerprint

This binary is a Delphi 7-era VCL GUI application with a Russian-language interface (TfrmBroot), presenting as a password brute-forcing tool with dictionary/list attack modes, threaded HTTP authentication attempts via WinInet, MD5 hashing, and system tray minimization. It carries no persistence, no C2, and no host-data theft. The threat vector is purely social engineering: distributed under a *.pdf.exe double-extension masquerade filename to exploit Windows' hidden-extension default.

Detection Signatures

Capa notes: capa failed due to missing signatures database ^[capa.txt]. This sample would likely trigger no behavioral capabilities in a default capa ruleset because the malicious behavior (HTTP brute-forcing) is implemented in custom Delphi code, not via suspicious API call patterns.

References

• SHA-256: b04aa5d0ede5653b20f6db6d6df0020e396dfe8688f2c4712cff6dccce2002d4
• MalwareBazaar / OpenCTI artifact: 823ab3da-4430-4469-9013-1c518e69f25d
• Filename as submitted: SALES_INQUIRY.pdf.exe
• Wiki: brooter — entity page for this tool
• Wiki: double-extension-masquerade — technique page
• Wiki: social-engineering-filename-lure — concept page

Provenance

• file.txt — file(1) output
• pefile.txt — pefile Python library section analysis and PE headers
• rabin2-info.txt — radare2 binary info (rabin2 -I)
• strings.txt — strings extraction (3,843 lines, UTF-8/CP1251)
• exiftool.json — ExifTool PE metadata
• metadata.json — artifact metadata from OpenCTI/MalwareBazaar
• triage.json — triage pipeline classification
• dynamic-analysis.md — CAPE skipped (no Windows guest available)
• capa.txt — capa failed (missing signatures)
• floss.txt — floss failed (CLI argument error)
• binwalk.txt — binwalk signature scan (only PE header and zlib copyright string)
• Custom Python resource dump — verified DIB bitmap dimensions and DFM form content
• Custom CP1251 Cyrillic string decoding from DFM resource