D:\a\OrcusRemover\OrcusRemover\OrcusRemover\obj\Release\OrcusRemover.pdb
Static task
static1
Behavioral task
behavioral1
Sample
OrcusRemover.exe
Resource
win7-20240221-en
General
-
Target
OrcusRemover.exe
-
Size
18KB
-
MD5
6a18060129b8ed019bbe6401439e7eb7
-
SHA1
556cda105713494da829a2b23696f1b1b2b1d4fa
-
SHA256
9434997f9207933115616cf6a3dfa6026675d08acf5ad08a74133a2334132df9
-
SHA512
1ddd2c4e7e8868d3d0ba20256411647b33e722e6ee60bd1e6df591dab16ab275b89bee351fddf392b2c9d3b6de9b48e127c23fabad5a88b5ff44489f1b779e7b
-
SSDEEP
384:0ox3KJBfZ5+NkP2QaCTBQtBW/BKScTiM/vRZJTl6dE80mmmrl9JUhsVlfW:0VZ5OtspKjp3r6qq6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource OrcusRemover.exe
Files
-
OrcusRemover.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ