C:\ADE\aime_1\oracle\oracore\bin\orauts.dll.pdb
Static task
static1
Behavioral task
behavioral1
Sample
orauts.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
orauts.dll
Resource
win10v2004-20240508-en
General
-
Target
orauts.dll
-
Size
9KB
-
MD5
80a22cb2cf85a1800f974f10cf2b606b
-
SHA1
4c5213581755fbfc6573e175e386c1fcce72f95a
-
SHA256
9124b6fbaa36696c6fa3b3341746184eccfc9f1be45ea90393537aa7d8405497
-
SHA512
b3521d23552ea460c77f1dd5afde95acb9aed75951716b50b2d2267241c47e93743150f1ddd4401ed70ece973ed92bf728b7c06b574e6939e9866547365454b2
-
SSDEEP
192:6UTKDOODCy4g5N4H7Alv/4XC5dGEbMNLQwz+1YO8Xwk7GhzKe:XTKDOsCy4g5NIk5dYfQY6B
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource orauts.dll
Files
-
orauts.dll.dll windows:5 windows x64 arch:x64
da99e55c172640738522ad26711064b7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
RaiseException
CreateThread
SetThreadAffinityMask
ResumeThread
RtlUnwindEx
TryEnterCriticalSection
Exports
Exports
CallNamedPipeA
CallNamedPipeW
CloseHandle
ConnectNamedPipe
CreateEventA
CreateFileA
CreateFileW
CreateMutexA
CreateMutexW
CreateNamedPipeA
CreateNamedPipeW
CreateProcessA
CreateProcessW
CreateRemoteThread
CreateSemaphoreA
CreateSemaphoreW
CreateThread
DeleteCriticalSection
DuplicateHandle
EnableThreadTrace
EnterCriticalSection
ExitThread
FreeLibrary
FreeLibraryAndExitThread
GetCurrentThread
GetCurrentThreadId
GetExitCodeThread
GetLastError
GetModuleHandleA
GetOverlappedResult
GetProcAddress
GetThreadTimes
IdentifyUserThread
InitUserThreadScheduler
InitUserThreadSchedulerEx
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LockFileEx
MigrateUserThread
OCreateThreadWithAffinity
OSleepExN
OpenMutexA
OpenMutexW
OpenProcess
OpenSemaphoreA
OpenSemaphoreW
PostMultipleUserThreads
PostUserThread
QueueUserAPC
ReadConsoleA
ReadFile
ReadFileEx
ReleaseMutex
ReleaseSemaphore
ResetEvent
ResumeThread
SetCriticalSectionSpinCount
SetEvent
SetFilePointer
SetLastError
SetOSThreadAffinityMask
SetThreadAffinityMask
Sleep
SleepEx
SuspendThread
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnidentifyUserThread
UserThreadExecRoutine
UserThreadQuantumExpiredCheck
WSAAccept
WSAAsyncSelect
WSACleanup
WSACloseEvent
WSAConnect
WSACreateEvent
WSADuplicateSocketA
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSAGetOverlappedResult
WSAIoctl
WSARecv
WSARecvFrom
WSAResetEvent
WSASend
WSASendTo
WSASetLastError
WSASocketA
WSAStartup
WSAWaitForMultipleEvents
WaitForMultipleObjects
WaitForMultipleObjectsEx
WaitForSingleObject
WaitForSingleObjectEx
WaitForUserThreadPost
WaitNamedPipeA
WaitNamedPipeW
WriteFile
WriteFileEx
accept
closesocket
connect
ioctlsocket
longjmp
recv
recvfrom
select
send
sendto
setsockopt
socket
Sections
.text Size: 1024B - Virtual size: 714B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 512B - Virtual size: 120B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 760B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ