Static task
static1
Behavioral task
behavioral1
Sample
OrangewareMain/Orangeware.exe
Resource
win10-20230220-en
General
-
Target
OrangewareMain.rar
-
Size
375KB
-
MD5
8f5b72a3771eea7a2790c89e086df470
-
SHA1
5faf5c7db98239b416db9b5c6d96cf005876a474
-
SHA256
3e7ec0fc4d3c6b96e15c6eb2eab34c35bf3076ba94c2eeb2b9d9657d66ea1730
-
SHA512
539eab3d501855b1114569f33ead042fef9f398d077fc75069b899b1ceaaf6cdcabee45ee5acfc00ec620864914ae8153cbeb908f69e8a74dbdad6d0f2c91322
-
SSDEEP
6144:UqAMFwtYh0epPxDsGmS0BlqQJQuqMerDA/mktefREhk6nvfnz:UpOOYhHpPxDsGmreQJdsKmDEiEz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/OrangewareMain/Orangeware.exe
Files
-
OrangewareMain.rar.rar
-
OrangewareMain/Orangeware.exe.exe windows x64
4b986ab7550267338936cf0a58b65cc7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
dwmapi
DwmExtendFrameIntoClientArea
kernel32
SetConsoleTitleA
OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetConsoleWindow
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
GetFileSizeEx
WaitForMultipleObjects
PeekNamedPipe
ReadFile
SetConsoleTextAttribute
GetFileType
CreateToolhelp32Snapshot
Process32Next
RtlVirtualUnwind
GlobalAlloc
GlobalUnlock
CreateFileW
GetLastError
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
GlobalLock
GlobalFree
QueryPerformanceCounter
QueryPerformanceFrequency
CreateFileA
DeviceIoControl
GetStdHandle
Beep
CloseHandle
Sleep
CreateThread
VirtualAlloc
VirtualFree
GetModuleFileNameA
GetModuleHandleA
DeleteCriticalSection
GetCurrentProcess
VirtualProtect
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameW
GetModuleHandleW
SetLastError
FormatMessageA
LocalFree
EnterCriticalSection
LeaveCriticalSection
SleepEx
VerSetConditionMask
GetSystemDirectoryA
FreeLibrary
LoadLibraryA
GetEnvironmentVariableA
VerifyVersionInfoA
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
GetTickCount
MoveFileExA
WaitForSingleObjectEx
user32
SetCursor
GetCursorPos
ClientToScreen
ScreenToClient
LoadCursorA
MessageBoxA
TranslateMessage
DispatchMessageA
PeekMessageA
DefWindowProcA
PostQuitMessage
RegisterClassA
UnregisterClassA
CreateWindowExA
DestroyWindow
ShowWindow
MoveWindow
SetWindowPos
SetWindowDisplayAffinity
GetAsyncKeyState
GetSystemMetrics
UpdateWindow
GetForegroundWindow
GetWindowRect
GetWindowLongA
SetWindowLongA
FindWindowA
GetWindow
GetActiveWindow
GetClientRect
ReleaseCapture
SetCapture
GetCapture
GetKeyState
SetCursorPos
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
gdi32
GetStockObject
shell32
ShellExecuteA
imm32
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
msvcp140
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Random_device@std@@YAIXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?id@?$ctype@D@std@@2V0locale@2@A
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?_Xbad_function_call@std@@YAXXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?width@ios_base@std@@QEAA_J_J@Z
?width@ios_base@std@@QEBA_JXZ
?flags@ios_base@std@@QEBAHXZ
?good@ios_base@std@@QEBA_NXZ
??Bios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?is@?$ctype@D@std@@QEBA_NFD@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??Bid@locale@std@@QEAA_KXZ
_Thrd_sleep
_Query_perf_frequency
_Query_perf_counter
_Xtime_get_ticks
?uncaught_exceptions@std@@YAHXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Xlength_error@std@@YAXPEBD@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
d3d9
Direct3DCreate9Ex
normaliz
IdnToAscii
wldap32
ord45
ord41
ord211
ord46
ord22
ord50
ord217
ord301
ord200
ord60
ord26
ord30
ord27
ord143
ord79
ord35
ord33
ord32
crypt32
CertCloseStore
CertOpenStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CertFreeCertificateChain
CertGetCertificateChain
CryptStringToBinaryA
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
ws2_32
WSASetLastError
socket
setsockopt
closesocket
WSAIoctl
recv
WSAStartup
send
WSAGetLastError
bind
connect
getpeername
getsockname
WSACleanup
getsockopt
accept
htonl
recvfrom
htons
listen
ioctlsocket
__WSAFDIsSet
select
getaddrinfo
freeaddrinfo
ntohl
gethostname
sendto
ntohs
rpcrt4
RpcStringFreeA
UuidCreate
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140
strrchr
__current_exception
_CxxThrowException
__std_exception_destroy
memcmp
__current_exception_context
__std_terminate
strchr
__std_exception_copy
memset
memmove
strstr
__C_specific_handler
memcpy
memchr
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-string-l1-1-0
strncpy
strcmp
isprint
strlen
strncmp
strpbrk
strcspn
strspn
isupper
_strdup
tolower
api-ms-win-crt-stdio-l1-1-0
fflush
_lseeki64
fclose
fseek
_set_fmode
feof
fputs
fopen
fputc
ftell
__p__commode
_wfopen
_read
_write
_popen
_pclose
fgets
fread
_close
__stdio_common_vsnprintf_s
__stdio_common_vsprintf_s
_open
__acrt_iob_func
fwrite
__stdio_common_vfprintf
__stdio_common_vsprintf
__stdio_common_vsscanf
api-ms-win-crt-heap-l1-1-0
_set_new_mode
malloc
calloc
free
realloc
_callnewh
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
sqrtf
sinf
floorf
cosf
ceilf
__setusermatherr
asin
atan
atan2
fabs
fmod
tanf
fmodf
_dclass
powf
pow
api-ms-win-crt-runtime-l1-1-0
_errno
system
abort
strerror
__sys_nerr
_invalid_parameter_noinfo
_resetstkoflw
_register_thread_local_exe_atexit_callback
_c_exit
__p___argv
__p___argc
_invalid_parameter_noinfo_noreturn
_exit
_initterm_e
_initterm
_get_initial_narrow_environment
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
exit
terminate
_beginthreadex
_getpid
api-ms-win-crt-convert-l1-1-0
atoi
strtod
strtoul
strtoll
strtol
atof
strtoull
api-ms-win-crt-time-l1-1-0
_gmtime64
_time64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
localeconv
api-ms-win-crt-filesystem-l1-1-0
_fstat64
_unlink
_access
_stat64
advapi32
IsValidSid
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
GetTokenInformation
GetLengthSid
CopySid
OpenProcessToken
ConvertSidToStringSidA
CryptAcquireContextA
Sections
.text Size: 690KB - Virtual size: 690KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 143KB - Virtual size: 143KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ