OorBuster[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

OorBuster.exe
Size

48KB
MD5

199a66862d2dd914a183bc95caa3942b
SHA1

3f86f98513718b56f65a606f97f30bd0f6660eba
SHA256

9728420faa7007e87ad0e90f00ccb0c4315a3e8b1ffb8b19e08593c9f36d0103
SHA512

ed806d6563e4dc2cf1a26dc567c1081eadd614c29cd17d6a9cb47c5a99485ca525231556556a044c8508857433989d379b25fe30e6b30eb154cf8ae56978f811
SSDEEP

768:LMb/irUVNirLSJCJzurrtOvV+0kDMJo7h:4buUVNirLriPDeo7h

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
OorBuster.exe

Files

OorBuster.exe
.exe windows:6 windows x86 arch:x86

90727566d443c119e58dbf8040d7586f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\vrt013918\source\repos\OorBuster-master\Release\OorBuster.pdb

Imports

dxva2

GetPhysicalMonitorsFromHMONITOR
GetVCPFeatureAndVCPFeatureReply
SetVCPFeature

kernel32

InitializeSListHead
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
GetCommandLineW
TerminateProcess
GetModuleFileNameW
OpenProcess
CreateToolhelp32Snapshot
Sleep
Process32NextW
OutputDebugStringW
Process32FirstW
CloseHandle
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
IsProcessorFeaturePresent
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime

user32

RegisterClassW
DispatchMessageW
GetActiveWindow
TrackPopupMenu
RegisterHotKey
RegisterPowerSettingNotification
MonitorFromWindow
DefWindowProcW
GetMessageW
PostQuitMessage
DestroyMenu
TranslateMessage
CreatePopupMenu
EnumDisplaySettingsW
SetForegroundWindow
GetCursorPos
InsertMenuW
LoadIconW
CreateWindowExW

shell32

Shell_NotifyIconW
CommandLineToArgvW

vcruntime140

_except_handler4_common
memset

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath_s

api-ms-win-crt-string-l1-1-0

wcscpy_s
wcscat_s

api-ms-win-crt-convert-l1-1-0

wcstod

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode
malloc

api-ms-win-crt-runtime-l1-1-0

_c_exit
_cexit
_seh_filter_exe
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_controlfp_s
terminate
_set_app_type
_configure_narrow_argv
_exit
exit
_initterm
_register_thread_local_exe_atexit_callback
_initialize_narrow_environment
_initterm_e
_get_narrow_winmain_command_line

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 708B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

90727566d443c119e58dbf8040d7586f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

dxva2

kernel32

user32

shell32

vcruntime140

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 6KB - Virtual size: 6KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 34KB - Virtual size: 34KB

.reloc Size: 1024B - Virtual size: 708B

.text
Size: 6KB - Virtual size: 6KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 34KB - Virtual size: 34KB

.reloc
Size: 1024B - Virtual size: 708B