�I�|���d�T�v0|�|�(�����~��^ V�`�z��Կ��q?L�]����X����]+v�����π�ܳ�GLNqD�Ⱥ���Ο������v{��h����U�X�H}���En��"i�֖��V$(��e�:�j܀�0�P����|��h"Ŭ��Q���b���L�ɰ 4��[?#�@�jR?�����ۤ�J�Tr�@�C~���{2�e侮Tt ��H���Z�� ")�{H&?�[S]!�Ŋ�CK�U���P% ��VaU.k�_̄Uz��X���AHTв��%���L+��4�+aش��C(M� ���#" 1�4����m����<�DMq��^�q�!�(�S�0Gz������MƱe�ިo&��غb}��i����<�����ľ$���ǟ���t����ڥ�6���s�5jWT�``���cY�([���*��@� (��5g�L���� Зj��:�@��>�w戇�=5��@�)1�)U�.fV�"��Sπ�Bt���k�<���<K��s���ƎAϞ#�;��}�~ܩ���]qq<�����H���G�r���gr�{b��Y��G��uz�|v���>Qi��#\�*N�6��S��d�Ҿ ���������0B�/�U5����F ��/)g �iS����"s�M���y���#f�������yMbϩ��/%��T�ȥ��x�[��6����/�T�bD��~��"v\�N���=I|�br�2�����QY����?P�DW)����c�}v�ί��E���KL�V�� 14��{�VHs|m@�M���6�_һ0����%��&�'^�`��b?���"}��4q�>T�D]F���� Ggm!��xx@]�U���G����^r�k�XPT�(���>�����E���UP'��Z�-!�P��f<9 �uU8�0����d��.�<���O)C,!�w "���+� �v�>��� ���>�"g�Z�eɬ��iw�}<�K.��Q=K�2Zt[���c�r�����!H5�ĺ�>ubA2�M}�����b�/ T�&�jU��N�ɽ��X�و��3�L��Ke�Go��ݕi�+�`�Ŗ��7'�Qp9� ������?��Ƃl�0 �{�.���M������8^/���%^y����DŽ��[.����)�ԅu�ޭ�7-�G|+��Q���9�odS9W��[⁸��qnB��5l���Z�t��F۹��#�$1N��L�bq��pW $��%���� �@j�/p�Y@a�(����ի��BCA��3ӫ]�<���{���R �H��;Y%�9���F�� o����'}�ӹE/6ӥ�:Sv�z��Q_5���6����Sy� ���{YW�ޕ����c~��&�9��G�ƴx��"3���\�"������c��h}hʟ�Ь �6��8���� ��X�l�%�`�]~�P���q��#����vޱU��Ah��ts��6�̿k�[;�+�`oxJ��\� "H+Ne�8g��(�S���J���x���B�%�=��i8��Y�B�+_��д}��X������f?<mr��zh��� $qZι���S�h!%���%���uCa$ ��"������"POc'ZȽ��db3_u;�pS�e�8���B�$����S�b � ���48<�q�d�$6@���'b��_x���)�&�Mc�D.��]0.�^Y"�3�dڻ�PB�=k!�a��?y�S�`��Bo��:s��P�T"��I�[E����Q�')9]���r�L��33�����~�s���|\�O.��.���t눶���j�E�,�?�d��}���#_�ǖ-~[7b�mȕj�M�����#�:�qǾ�+����|X�OQ]�Һnt�~�2}����x�5#�9 ��j�k���v�9����b�K�]c�%�邢�lC����`UtQ��+��{�4D������)Ǘ�*�.o���4]�oG�е�֧ ����y���.곆B��k�vA,�� ȧ���ņP�bNTs(���}dTK��7R��涤�L�Ϥ��zRÁ���T���P���7�>Q���9P`Z���gò�M��s���5|p���=[��$h���]�8�6![��u�0�-��ֱJJZ�-)�Lr��A>�ۏZ�X�f�����b���U�� D��{m��Su���^�z�N������l�@�Ǹ�eZ`Px����69RL?ĭ���\�9�/Ahn�:ABp.F�S��b>�8Y�p���zBS!Y^��r�R�dE�������`A+U����䘾I8`M�7�l]*H�:g�>sqE%��?���<Y5�����^A���4%K���U���̌E&Ű�羔�0^f�(�eYb9�S|����}�ڕp*.����t��a �����E�z���?(_�JR��X��p�k|�3���>��ڊ\���$.�D���{�D��A��Օ볎���8�E�kcMD�c�1P�{S\���6��q? ����ԥ�N��I�-ڎ��N+Sw}4��U�AV;��be qs�m���[?�6�dMr0U�$�\���5�oHK��&:6!�q�rP�t������K �/���Ѹ��:��I�n�.��(��niL$��4�U�"�skô�Wæ�����0��n���=V�� ��O��zz�~}�=3�pR���� ��! c`Ħ�4`��#3ݑU�g�J�)�����ϊ�ߝ���l��ϹP��E��3�/�p;ݾ���d29_��Ug��3_�m�D�����uទjz"zHIy����G�*F����uF#C ���J�U�����Dh��!>���Aɔ�ov����0;$i}�(�̛K1�!|�~z%�;sj�S|[�2�3�>O�H�hC����MÅe屪��/����zkw��VyQըj�g�;F�B9�5w�.$����[]�9R�H�F]�=���M,��O�bU�W����Q����\l��*��}�]�H�,U�u���N����n���v������H����d*�Io�����jz�����QI�����_�Q�e(c�
General
-
Target
Orangeware.exe
-
Size
5.0MB
-
MD5
f811ccd93ffb3f95936cb5c27fda2c8f
-
SHA1
33868ea6068f0891f102fed02e2ef571b214caa2
-
SHA256
3823c1da096ee28ebd08b28e245ca73054ae56a12d807ceb3078e4361f34dafc
-
SHA512
cd9036ad9f453e6f950db7f42e646c3861d927ad940ab50cacfe7fbe00812328991c2b7037b9009003472dd5d4b71602e5ac3aac18a0e137ff893c272ab1db04
-
SSDEEP
98304:W5ewUGTeiPA3KXIRz1oWodf9egZnKJTWwO8jWU0J9i7UYKSkY/WTR:5tGf4zzzmKJzOF5cUY5+T
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Orangeware.exe
Files
-
Orangeware.exe.exe windows x64
81b5d6c927f9e23858d4be4a6c0c0141
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
SetConsoleTextAttribute
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
msvcp140
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
urlmon
URLDownloadToFileA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 4.8MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 234KB - Virtual size: 233KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ