Static task
static1
Behavioral task
behavioral1
Sample
Hook.dll
Resource
win7-20231201-en
Behavioral task
behavioral2
Sample
Hook.dll
Resource
win10v2004-20231201-en
Behavioral task
behavioral3
Sample
OrkBot.exe
Resource
win7-20231201-en
Behavioral task
behavioral4
Sample
OrkBot.exe
Resource
win10v2004-20231215-en
General
-
Target
3a4eeb57e670976edcad791a3b52d71f
-
Size
106KB
-
MD5
3a4eeb57e670976edcad791a3b52d71f
-
SHA1
e7aae814f2ef476b2367b29df6840a44fa40105c
-
SHA256
6f60e643800ed84586976250a6b9e7e769a26602ff2608dccf078597373eb691
-
SHA512
0f83d7fbe4d0c2ab66ab61d30b223f9c4ad466a7b992316762975684fedfe43270857e2e57a4915be194c8dedf0eb061a0fbb824991e62c3199e00d33014db7c
-
SSDEEP
3072:Mx5DcNevq9GkBsm4qEtCfhA2N5BGS5fZOY2h99ME:M7HvqNymXEtCVbbBSh9CE
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Hook.dll unpack001/OrkBot.exe
Files
-
3a4eeb57e670976edcad791a3b52d71f.zip
-
Hook.dll.dll windows:5 windows x86 arch:x86
43d4356f8aec0620d94a432f7d4eac58
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
winmm
timeGetTime
kernel32
GetLastError
VirtualProtectEx
DisableThreadLibraryCalls
GetModuleFileNameA
GetCurrentProcessId
LocalFree
CreateThread
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetProcessHeap
SetEndOfFile
GetLocaleInfoA
Sleep
LCMapStringW
LCMapStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
LoadLibraryA
HeapSize
FlushFileBuffers
SetStdHandle
HeapReAlloc
VirtualAlloc
CreateFileA
InitializeCriticalSectionAndSpinCount
ReadFile
MultiByteToWideChar
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
FormatMessageA
GetStringTypeW
GetCurrentProcess
GetConsoleMode
GetConsoleCP
GetStringTypeA
GetStartupInfoA
GetCurrentThreadId
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
GetFileType
GetModuleHandleA
DeleteCriticalSection
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
RtlUnwind
HeapFree
CloseHandle
HeapAlloc
RaiseException
ExitProcess
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
SetFilePointer
WriteFile
user32
SystemParametersInfoA
GetMenu
SetWindowPos
EnableWindow
ModifyMenuA
GetMessageA
RegisterClassExA
TrackPopupMenu
SetForegroundWindow
LoadIconA
FindWindowExA
SendMessageA
TranslateMessage
GetKeyboardState
GetWindowTextA
MapVirtualKeyA
SetWindowLongA
MessageBoxA
CreateWindowExA
GetDlgItem
EndDialog
DefWindowProcA
GetCursorPos
ShowWindow
CreatePopupMenu
DispatchMessageA
IsWindowVisible
InsertMenuA
SetWindowTextA
UpdateWindow
CallWindowProcA
DestroyMenu
LoadCursorA
DialogBoxParamA
GetWindowThreadProcessId
gdi32
CreateFontIndirectA
CreateFontA
shell32
Shell_NotifyIconA
comctl32
ord17
Sections
.text Size: 95KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Hotkeys.ini
-
OrkBot.exe.exe windows:5 windows x86 arch:x86
6357bf600b0a4c663d1cbb6a45d03641
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLastError
GetProcAddress
VirtualAllocEx
GetModuleFileNameA
GetModuleHandleA
CloseHandle
WriteProcessMemory
ReadProcessMemory
ReadFile
GetProcessHeap
SetEndOfFile
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
VirtualFreeEx
CreateRemoteThread
OpenProcess
HeapSize
WaitForSingleObject
GetCommandLineA
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
HeapFree
GetModuleHandleW
Sleep
ExitProcess
WriteFile
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CreateFileA
InitializeCriticalSectionAndSpinCount
HeapAlloc
VirtualAlloc
HeapReAlloc
SetStdHandle
FlushFileBuffers
LoadLibraryA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
user32
DestroyWindow
GetMessageA
RegisterClassExA
PostQuitMessage
LoadIconA
FindWindowExA
SendMessageA
TranslateMessage
MessageBoxA
CreateWindowExA
DefWindowProcA
ShowWindow
DispatchMessageA
GetSystemMetrics
UpdateWindow
LoadCursorA
GetWindowThreadProcessId
gdi32
CreateFontA
comctl32
ord17
Sections
.text Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Settings.ini
-
Teamlist.txt