5�0ٴ��7k�jF�|ۚ�R ^����R�f %����+��MH|(�����.�^(�FjL�A?8��:$��p��-=5%���� ��<W�M�2�4�Cտ���ڣ\��#8hb�9T0"��欀N�U�x����>���M>k�@;0�uӗO��eXn���]�$��w�q��$(����;��d,'1���|x�`�װb��@�:*߄#4�Ħ�2�8���l獾�j�\��Z�?l���~c,�a�ģb��u�`A���ٲO��V�~I3� �[��4;��@����ȑ�z�Ӓ%�p�tW�l���L��n�K�o>� ΅�1wH�bϡ�N�YWyi��.y|p��r#&vw����$!��QŶa�.�&��w� B~y�bh��y�kiu�=���3B�˚~���`���q���Fjo��,C�>��{��ȘE������OtR:Ÿv��� 1y]# /�����:���!8����S|�h�Y���� h�\�-k��'\Ξce��ږ�JcL_�����~�%�UƬ��>8 6�5�9$k�}ъ��-vM�Gp0^!�J'(���E@�������A.V.�Z�{w�O~�H���8Ʉ�u$�/��]�H�ho�o���m����@��?��3i`����� �(:��/qP�ѐꖦ�4��O\c��.� �Y[?�ɿ�Svf� �x����=���*o ��]��c:�"�rZu�h���\��RXQ=��4��M/�盿���������g��*W<��^�t�T�Q�V��3_����b�d�����=�����T����H^� ��9؈(�噘�J�������^��RF����n�;:�[��[��d�����J�w�O�*[b��ª���. �oP���6zuq|�9��laɩ+:�����d4�'��'I�J�;f��|/2��y��ᡬ.G���2p�%�ƺc�������{���݄��c��hO�q�����+ΰQrK��4 Oik&Q��dX�~3)�����]�MU%�M�]=��韑j���y�d\�v�N��R���ߌ�{��f�A7K�_NeK��ߞo��"��8�HN$��i`J&iK�`R�w��� �I��:ݛ!�h{w�O�"��i:SG�"�k�ρ�ZEB{���H5(�Tu[�־({CZ���"� �Sʜz⻰=�Yʬ��^B�Mb�/�:��j1��UC��8ޖƮ>K�\��������륿G_�U�n�Q�{<-ƚ�9rR3�~<������C�O$q��+�����%S/���.M� ��~����,Di���`�fQ�;���� ���~W�C��3-�j~��"�������̭B��.��k�6uC�?7�@f�n�I�r�m+Z�4�,��,�>�¤��d��7���j`J�N�7p�30�����!�rS���>���,v#1��ߺ8�+}��(\����ֺb�$�B��M��<~Їqfb�Pc��1�X������!���;�������̊��{��wd Ȱ� ~5��q؍Y�5�vPFf��j�N;�$�Kvg@�cA�{�}����;��1����r�zD������+�j�/<��ǽ���xΝ�ȭ=�Ie"���@��k���=�Ȭ��6��A�/�d�z��%�M'��3��&���\�y��dK�`��]���ی�`����V۴��Zz�?��]��'�"|�iC�|�F�[W���R�&�+Q� �L]����18.X�cɿ�2g&���2}��������3<�N��t*��9���Dž]~������}��^�������/DUʂ�S��*Ő^*��b����)t�e�7�b\�,��k���I�hK���߹�;(��"��+��=w9�(�u6oG���*jRl��|� ߟ~_��U:Z�7>�8��v ��b�W8@5����Gh�+v���)Ґ�`z�Ng��(]��UY_;��#���elh|�n-x;H�n�Yɯ� �|%�!�����x��#VIˤ V#�i0�3� /&8�|>2j�nG����YM�K1�� `�7�9�P�{3�"�-�Sg�R�P�:����;�@�F���\����o�45��ا6wļ,���,����y��z���z*W!R��M���%a�����f=E�俚����1��E�����X�����^ n��y�] ��s���k�A�p%����)|�v��2���)������1��qW.��t�?��6�};�_���$e����^�fF�l��/煟������� ~�էn2\�����dif�7!�=�C� ��^r��s�3y(��鄌TJ=��`�I,T�-��w��UeM!�����9��e;�80l���>?���ll�1_.FF��y}|�k�Qz"�akk'���6V,��~��?g�A�.��;W��}�P���Ն+���Cn`���G~���f^B=�R��2�LN-���wYh�۷Sg�-u\I���ࡸ6�"kl&��v����~]��7)��IK'A��Wv��z�j��9]4��T��B�[g�z����8��k�=k)��Q�Ra���^�AJj������YoKtݏ�����"�dS��%_:��x�V�Z���h�t�-���L�ӪiB�0���N} yQ���-K&�k�(���G��a)W6��7�?��!�R/�m���*����r���CZG�`�Q�$�Q��*{���mQ�4�"�t9H9��ZW�*��4� ��DruO�j̫Lʧ[��&��\��� �X��8���q�}��OQ��U�� ˝ 0$i� ���緹�U8t.\i��1}�C�J7Җ����J�����ږG���~W�r�"km�,��HN�&~P����=:�pp��BNw ���h���Zz ��nSD������H��\��r��O������O��� ��bl�}�� x[G�̠~3��)�?�h�%���#�Ҟ�<�Y�nt�<���9�#8{�����i���Y�~�]p���D�P�챖`ۑ۫*��h?��z@ ��{!��^Q+�`�[!)���HG��\��Y:iw xw~M״P�D�����B}�I>��L
Behavioral task
behavioral1
Sample
oreki.exe
Resource
win7-20230621-en
General
-
Target
oreki.zip
-
Size
658KB
-
MD5
3a420a36c15ba42304490604f6ba8771
-
SHA1
4b631bf81d12dcae100bb27919613bb3c9512c2c
-
SHA256
a144012cc885250dacdd182b23da4620b922aa509faafe81487626cc6d62f58d
-
SHA512
e8a14f6cf547cb4f7b336e0d70961680a8c720d1b1a8b82e906ff88aef852b2511570d8cca756df7a2efa751823e2fcec717fe0d31f7c8cd107b8525295acded
-
SSDEEP
12288:e1xTo6W8GCz9T4SQVOnyALLcFZ/rpenAgkXwJyzERivyhn9S9oTKKFHpDF/r/ED:sVxzz9T4XVKRcFlrpenYXQyIeo8HQH7O
Malware Config
Signatures
-
resource yara_rule static1/unpack001/oreki.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/oreki.exe
Files
-
oreki.zip.zip
Password: infected
-
oreki.exe.exe windows x86
36f8cc26a3f70ac7886f4d6231e8c633
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
TlsFree
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
msvcrt
_write
user32
MessageBoxW
Exports
Exports
Sections
.text Size: - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 1020B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 17KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: - Virtual size: 588KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 661KB - Virtual size: 661KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE