Behavioral task
behavioral1
Sample
2ce2ae61873e5d585d36efc823d311409ad0f504c55f1d044199a35e0ce67880.exe
Resource
win7-20240704-en
General
-
Target
2ce2ae61873e5d585d36efc823d311409ad0f504c55f1d044199a35e0ce67880
-
Size
903KB
-
MD5
fe3318487162b45cbe34d8c8876d4c55
-
SHA1
5c55217bcb60622dbcf779cc2892d74a8026dffa
-
SHA256
2ce2ae61873e5d585d36efc823d311409ad0f504c55f1d044199a35e0ce67880
-
SHA512
2eba77e2abf648afae7b4c4911ffa75b5a980faaabfc29fd8b50b1ac720341832452ae83c4efe61155493268d2107a8ede9217c272772d91ce44699bc3c1cdc9
-
SSDEEP
24576:PbDS04YNEMuExDiU6E5R9sdOQnQ2M+Y+Ibj+r:zZ4auS+UjvxsIbj+r
Malware Config
Signatures
-
Orcus family
-
Orcus main payload 1 IoCs
Processes:
resource yara_rule sample family_orcus -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2ce2ae61873e5d585d36efc823d311409ad0f504c55f1d044199a35e0ce67880
Files
-
2ce2ae61873e5d585d36efc823d311409ad0f504c55f1d044199a35e0ce67880.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 846KB - Virtual size: 845KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ