Orcus[.]Server[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Orcus.Server.exe
Size

3.2MB
MD5

700a14ba55fb47f9b8a99ffa92267125
SHA1

43ef6ab246ba72d39cd1a72dd83fee68aceba493
SHA256

594f18a0b5b83c1c64c75830f8e9b2bd4d4629c9c5b9c70b3aa5f0f17b22789a
SHA512

c4ab308a65f267edee887085d358df1ddf83e55fa8f3507209cebc5b44e755f17d583956d170e57e6644d70505a175d58a17f1cdaab13ba7431c4185594804b4
SSDEEP

49152:VB+4yPRRGCvw2/986nZGeE9gwPs+vnEoXevXCdJsur8BF0xXIHnqww5VCkkhQIGa:VB+4mRF42/986wgzMEop+OxXIKZExc8

Score

1^/10

Malware Config

Signatures

Files

Orcus.Server.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

78:22:43:a1:53:df:28:0a:1f:fa:e1:5c:d0:28:4c:86
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

16/12/2015, 01:00

Not After

16/12/2030, 01:00

Subject

CN=StartCom Class 3 Object CA,OU=StartCom Certification Authority,O=StartCom Ltd.,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2d:7a:a4:85:ce:ab:ea:0c:ef:06:69:5f:f4:c1:47:72
Certificate

Issuer

CN=StartCom Class 3 Object CA,OU=StartCom Certification Authority,O=StartCom Ltd.,C=IL

Not Before

05/04/2016, 16:50

Not After

05/04/2019, 16:50

Subject

CN=Orcus Technologies,O=Orcus Technologies,L=Markham,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning

Key Usages

KeyUsageDigitalSignature

78:22:43:a1:53:df:28:0a:1f:fa:e1:5c:d0:28:4c:86
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

16/12/2015, 01:00

Not After

16/12/2030, 01:00

Subject

CN=StartCom Class 3 Object CA,OU=StartCom Certification Authority,O=StartCom Ltd.,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2d:7a:a4:85:ce:ab:ea:0c:ef:06:69:5f:f4:c1:47:72
Certificate

Issuer

CN=StartCom Class 3 Object CA,OU=StartCom Certification Authority,O=StartCom Ltd.,C=IL

Not Before

05/04/2016, 16:50

Not After

05/04/2019, 16:50

Subject

CN=Orcus Technologies,O=Orcus Technologies,L=Markham,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning

Key Usages

KeyUsageDigitalSignature

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

99:5d:44:cb:a7:e8:76:73:9c:36:7a:2d:09:c4:76:0d:2b:98:90:a2:b9:23:b7:37:a6:54:76:da:6e:c1:78:da
Signer

Actual PE Digest

99:5d:44:cb:a7:e8:76:73:9c:36:7a:2d:09:c4:76:0d:2b:98:90:a2:b9:23:b7:37:a6:54:76:da:6e:c1:78:da

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Orcus Technologies,O=Orcus Technologies,L=Markham,ST=Ontario,C=CA

17/04/2017, 17:08
Valid: false

b0:6b:38:c6:66:6f:89:c8:41:00:79:f8:42:85:1a:b6:72:50:03:09
Signer

Actual PE Digest

b0:6b:38:c6:66:6f:89:c8:41:00:79:f8:42:85:1a:b6:72:50:03:09

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Orcus Technologies,O=Orcus Technologies,L=Markham,ST=Ontario,C=CA

17/04/2017, 17:08
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

78:22:43:a1:53:df:28:0a:1f:fa:e1:5c:d0:28:4c:86Certificate

Extended Key Usages

Key Usages

2d:7a:a4:85:ce:ab:ea:0c:ef:06:69:5f:f4:c1:47:72Certificate

Extended Key Usages

Key Usages

78:22:43:a1:53:df:28:0a:1f:fa:e1:5c:d0:28:4c:86Certificate

Extended Key Usages

Key Usages

2d:7a:a4:85:ce:ab:ea:0c:ef:06:69:5f:f4:c1:47:72Certificate

Extended Key Usages

Key Usages

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77Certificate

Extended Key Usages

Key Usages

99:5d:44:cb:a7:e8:76:73:9c:36:7a:2d:09:c4:76:0d:2b:98:90:a2:b9:23:b7:37:a6:54:76:da:6e:c1:78:daSigner

Signature Validations

Verification

17/04/2017, 17:08 Valid: false

b0:6b:38:c6:66:6f:89:c8:41:00:79:f8:42:85:1a:b6:72:50:03:09Signer

Signature Validations

Verification

17/04/2017, 17:08 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 3.2MB - Virtual size: 3.2MB

.rsrc Size: 43KB - Virtual size: 43KB

.reloc Size: 512B - Virtual size: 12B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

78:22:43:a1:53:df:28:0a:1f:fa:e1:5c:d0:28:4c:86
Certificate

2d:7a:a4:85:ce:ab:ea:0c:ef:06:69:5f:f4:c1:47:72
Certificate

78:22:43:a1:53:df:28:0a:1f:fa:e1:5c:d0:28:4c:86
Certificate

2d:7a:a4:85:ce:ab:ea:0c:ef:06:69:5f:f4:c1:47:72
Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

99:5d:44:cb:a7:e8:76:73:9c:36:7a:2d:09:c4:76:0d:2b:98:90:a2:b9:23:b7:37:a6:54:76:da:6e:c1:78:da
Signer

17/04/2017, 17:08
Valid: false

b0:6b:38:c6:66:6f:89:c8:41:00:79:f8:42:85:1a:b6:72:50:03:09
Signer

17/04/2017, 17:08
Valid: false

.text
Size: 3.2MB - Virtual size: 3.2MB

.rsrc
Size: 43KB - Virtual size: 43KB

.reloc
Size: 512B - Virtual size: 12B