R:\gpUUcUpihJj\tVhtFYAPM\bpHbphqzxxuzvz.pdb
Static task
static1
Behavioral task
behavioral1
Sample
Pc.Optimizer.Pro.6.1.3.2.key.code.generator.by.orion.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Pc.Optimizer.Pro.6.1.3.2.key.code.generator.by.orion.exe
Resource
win10v2004-20240226-en
General
-
Target
e1102785e9176cb98b769b4fcb18618b
-
Size
148KB
-
MD5
e1102785e9176cb98b769b4fcb18618b
-
SHA1
0540fe89d9cbe215e0f283df8323149a95eb3f47
-
SHA256
663a8e5c62943f27cff7201946d60f3ea88490e63bc053f5463ddcb39b43eb2b
-
SHA512
ed7ac6ff60bdb34318bd57859d799c99df3592ed7dce7b8d424d5ad8e8de8f2a9eac3dc00a62900cdf769bff164327295e82e785b51db17ecb43906b84ca8723
-
SSDEEP
3072:o3ZASP54TD0WGEbcWMWsOqLeSptqJTGyNtXxdRjDEgiVZJ6DEpWSI6:p6581MWsHLeEtqDNtPRU1J/vI6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Pc.Optimizer.Pro.6.1.3.2.key.code.generator.by.orion.exe
Files
-
e1102785e9176cb98b769b4fcb18618b.zip
-
FILE_ID.DIZ
-
Pc.Optimizer.Pro.6.1.3.2.key.code.generator.by.orion.exe.exe windows:5 windows x86 arch:x86
dc2f904e64bedc3b055b56af52e3c955
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
user32
IsWindowEnabled
GetClientRect
GetForegroundWindow
SetFocus
OffsetRect
AdjustWindowRect
IsWindow
GetTopWindow
kernel32
GetCompressedFileSizeW
GetFileType
HeapReAlloc
GetVersionExA
GetSystemWindowsDirectoryW
GetShortPathNameW
ReleaseSemaphore
MoveFileA
GetSystemDirectoryW
UnmapViewOfFile
DisconnectNamedPipe
GetCurrentThreadId
CompareFileTime
SetTimerQueueTimer
ntdll
RtlCompareMemory
Exports
Exports
?InsertFil
Sections
.text Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 74KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fxc Size: - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.fx Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
orion.nfo