۹(�����D<�U!Orh[j��α��>�.�$z�V�+(�6����$�&����(�L�Ff���7�}jl��n��76&��m��X>j��µk��K�[v�B)�4�Z���|�~��,�A]�{(+�Mǡ�oG1�YP�3<;�l-��ᇓm���F0��T����������xu�eWź� ��6�+/_Uy�C�t�^����`c/���O��5�@�r'�� ���C�P��!��������%I�,������Q~��f�1��٩8-M`,TC����@��z v�+��K��ӷ�T���P��^� ��F��;G�z���*�v]y��)c!���`���efʼ��%^�{���x����#���� ���-�\j�G���S�VSE�b\��V�f��F9l���櫵.�nv�|Qj�h+]������D�ȐJ�����(�G�Ĺ�^�W�1@���^0����H}�8v��='��L�MU��Z�z��˜nA%./d��-rK��{슢o��ț6B��R��^j,Y0�yG��Pg�$U������ e�nj�X'MqG2����`|%�)E�F��k?�G*vƼ_ �5����Ku��d����H��Fc�zh�k`�r^}_�xK�PܰR;`:ֳ �q�������GZCt.8WY�)8%���H��dp,�i�\���d�F�ߋ��7�����2����z>�K�5��1��T*A���98H�˳�bD��ܼ�LL�sz�?�:sA�H ����B*�Mw�g=�I�Ls������R��/ �~uᤑ|���h�pk�͗Ò-9@����w��d���VC���q�m}��Ƚ��-5�j�۞�<a�Ķ�g1=ـ���ٕ����������� ���ό�őr��w���j-;���'*c@�ڭ��=&���V-��G��p�7��J�$�����@14���h�����j� ����<5��鑶���� V�a��ss����o�E�)gq����izDQ�T�,{�gVO{;[�P7�~j�\��[�u��c���t��B_~�s|@���&m��f�0B������s��\�k�FE�s�Y���{C�i< �� ~;�R�r1e8����y�GT��������fOJ�����Lo�Ttt?��qP���g͐����ؓ3 �z�ɡb�-<�"��[������5�������gw�i�W�������Tb�E���_e�i9�,.B'�@YR�?�t�bM��bNJ�VOJ����z���w��^H���vC�"�?���#�����73'��������ً��>��ꞓ���ML��:���\�<ͺ>]+��Oy\�Yc����T�Wa��c���Ҥ��K�-hʘ�W����շc{�}^�Z����wfO����R�>B���}u m)��Dl��}�(�8�&��iì/N���N��M�CSմj!��n�W�ʢ��;W��*V��\���r��s��L?vc��(��*����'X{��+�?�n���oEg�(�l��Pi*����%����Q+Xͧa"��>����z$[ӏ��k�+TےM��-�!��?�j�&� Ei��Uo�܈'h F+e���6wX�4h�QH� ����e�7Ӈ�V����W��K�kʹ˖������f捷S�TDmR�ux�5�L��@@�=�yA!xm�6<��\�ɂ�~��?҅���M�wa�{ ���sK�#�����%�|�@\f;���D�# =����%,O ����La��fNM��,��㘮���w�)����'b� �������ޥvԾע�u�� ���7������ �`>�T��P�p�Z=ֶoS{`�G ��*�>L���9����u�8�^�ę���-6��o&]�`�=ċrH67�����;n��t�G������\�@p^8���������غ娠��*~��*�����x��>�X�f�9��.Z|@<�Ó)��mc����=�k�J��ϧE���-$��7꺟��^����ϒ��E�cC��b�����������TwG�<)5'(�6xe�5ބ����O��>Wܹ��&ضw5�o?�ā���x�*��*|��z��I����rɣ���8�M�� b �^_2����\�SC�e��N�GZ+���5h����˕�#l/��k�ڢ���z`�~������ n�k���ꅕ��3N$G�OHx�-�@��&$\W�'����zcA��[U�y�@���_�b�S/�,��G�L���@���n��0�����d) 8����oΏc�;Z�$���[�i2p�a�*Y�E���,�Y;�i�B}d$�y�q�V<�[����H��ɬ���zE���Pܘ5R9�8P�R ��j�.��E��DYa�&���o_�����w�6!x���C'���~���p�`l�^<(�x;������j<�.���w��.��j�.��w;'_��'6�Q(w6>FK���j����%_����a�� ��E�P�Ceq|��8�c/ȊS߆ٸ�~"<netH��-���x���]/ka�>ګR.�`C�:�͕)���ri�:pI�;u�x�Z����z(�Y�c������p��C�rdž� M��+��YA V�펪�_��?l�0 ���`s|dno';���� ��o�oÛ�7�֒����8�Lu+׃�"���n0�ui�����.�qH�pF��` ��ߑ�Z�4jV��@�#c�S��12������d���k� ÝJ�9IAs�����u��Xh � ��ø�:�H_Ԛ&���GG��{�m�iؐ���E���Ab#E�)�J�So�{D��v�}����R�YP� ������َ�������=�����G��&���y ���UC(v��J��꿞-��?^=��k�)0�gti�F>~��~�8����X��U2����� �i�,�3��x���°���|��ct�6c�_<��SV� Ք��\Ͱ\�)ɑ]��ʴωh�`/��$��s�J��0湏��x9��H�����`)��7�۔�p����Pt���������������r�A�韸>9_�˶F�;�MY��P
Static task
static1
General
-
Target
Panel bypass Orgasmo.Net.exe
-
Size
6.2MB
-
MD5
d0de77a596429b1ce5e77eceb406db22
-
SHA1
1ac0fe7e2ea0e3e3d8ba3ca3bf1de13cdfa3e685
-
SHA256
3531a952c5dc86a98ad743280480314e5b7b6e1866ed32b666063c88717fc728
-
SHA512
601be5d16664849c41fc25393ae38abe2194e396c163307f0b69eecee27176681ea8efe1afe268aa6bfb3ed47ed9037c07bd220236def650924c7f928858b346
-
SSDEEP
196608:ezIY/WUY99CyBP7D0X1t8zkviVh8l4nTGwqZU0EgLf0/Q:4W99HPf8mAiYenTGwqagD0o
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Panel bypass Orgasmo.Net.exe
Files
-
Panel bypass Orgasmo.Net.exe.exe windows:6 windows x64 arch:x64
fb9fbd68547db0703f1dcba72d2eb0fc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetConsoleWindow
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetClipboardData
CharUpperBuffW
advapi32
CryptEncrypt
shell32
ShellExecuteA
msvcp140
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
normaliz
IdnToAscii
wldap32
ord211
crypt32
CertFreeCertificateChain
ws2_32
getpeername
shlwapi
PathFileExistsA
psapi
GetModuleInformation
userenv
UnloadUserProfile
ntdll
RtlVirtualUnwind
urlmon
URLDownloadToFileA
vcruntime140
memcpy
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
__p___argc
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-stdio-l1-1-0
feof
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_fstat64
Exports
Exports
Sections
.text Size: - Virtual size: 425KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 138KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.F{U Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.'K5 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.=wU Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ