ProjectHook RAM Scrapper ProjectHook is a RAM scrapper malware that someone sent me on ICQ. The malware cost 1k according to him, im not sure if its this guys: MD5: a599836a7bbc68a5e712d48bb6319951 The original exe is packed with UPX and have a size of (447 Kb) After unpacking the exe size is 1,36 Mb and the time date stamp is 5061B8CA (13:59:38 - 25 Sept 2012) First seen in VirusTotal in December 2012: Lets dissas it ! FastMM is a lightning fast replacement memory manager for Borland Delphi Win32 applications. On the main procedure, at first it create a mutex MTXCTRL: If the mutex cant be created then close the process. It call GetModuleFileNameW to get the malware path and compare the end of the path with mmon32.exe if this dont match we will enter in a procedure: After it will take the string APPDATA and use the API GetEnvironmentVariableW to get the path and compute it with the string Memory Resource then he create the directory Then take another string Memory Resourcemmon32.ex...