> Technique · Delphi VCL Native Stub → .NET Metadata Loader_

~/packetpursuit $ cat /intel/techniques/delphi-vcl-dotnet-loader.md

typetechniquefamilyloaderconfidencehighcreated2026-07-17compilerdelphidotnetloaderobfuscationresearch-target

Delphi VCL Native Stub → .NET Metadata Loader

A delivery chain in which a Borland Delphi VCL native PE32 executable acts as a dropper/loader for an inner .NET Framework payload. The .NET assembly is stored without a standard MZ+PE header — only raw CIL bytecode and .NET metadata streams (BSJB, #~, #Strings, #US, #GUID, #Blob) — and is extracted, optionally XOR-decrypted, and launched via WinExec or CreateProcess by the Delphi stub.

Observed in this corpus

  • Sample 0ce2a9be — Delphi VCL stub with DVCLAL/PACKAGEINFO resources and SOFTWARE\Borland\Delphi\RTL registry string. Overlay at file offset 0xA200 contains raw .NET metadata for an AgentTesla infostealer. The stub calls FindFirstFileA to verify overlay size > 0xA200, XOR-decrypts the overlay, writes it to a temp file with FILE_ATTRIBUTE_HIDDEN, and launches it via WinExec. ^[/intel/analyses/0ce2a9bef251a42648a4ef198c4da7cb4c707b9635b13036d3d552fc87ac1566.html]

Identifying characteristics

Indicator Notes
Resources .rsrc contains DVCLAL, PACKAGEINFO, MAINICON (Delphi VCL runtime signatures)
Strings SOFTWARE\Borland\Delphi\RTL in .rdata or .data
Imports kernel32.dll, user32.dll, advapi32.dll, oleaut32.dll — VCL runtime surface, no overt malicious imports
Overlay Size > 100 KB; first bytes are CIL-like (0xd3 0x17 0x00 0x70 ...) rather than MZ or encrypted
.NET metadata BSJB appears inside overlay, not preceded by a valid MZ+PE signature
Launch WinExec or CreateProcess with a temp-path argument; SetFileAttributesA(FILE_ATTRIBUTE_HIDDEN)

Why this matters

Static triage tools that look for embedded PEs (e.g., pefile, binwalk with PE signatures) will miss the payload because there is no standard PE header. The metadata is only discoverable by scanning for BSJB or by entropy analysis of the overlay region. The Delphi VCL runtime bloats the outer binary with harmless imports, making behavioural signatures noisy.

Detection ideas

  1. Overlay entropy + BSJB scan: Any PE32 with an overlay > 50 KB that contains BSJB but no preceding MZ+PE is suspicious.
  2. Delphi VCL resource triage: Flag samples with DVCLAL/PACKAGEINFO and a large overlay.
  3. Dynamic: Monitor WinExec/CreateProcess from processes with large Delphi module footprints spawning .NET child processes.

Related