Behavioral task
behavioral1
Sample
Orqur.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Orqur.exe
Resource
win10v2004-20240802-en
General
-
Target
Orqur.exe
-
Size
8.8MB
-
MD5
b11a6d1f6ecdb3dbb576aee355f83b56
-
SHA1
ce99da9f64f2c00a9f47bd6a436e0677bcdb9b8e
-
SHA256
af0086b6522424632523e28e39d416be80525b4db70ba1949f8fa5a66a4427ef
-
SHA512
d18f04021bf84c1ce9d3154a540a8b202047bd79cee9fc5ba25883a685da22ab1b4f2e647b03e0f59d7fbba7aceb5c558c0ee9b63926bff32cf6a89d39ece41f
-
SSDEEP
196608:tYnRG7NEQapv2OM4msC/307C1c/NDNqCsbTyi0oiu/HPR3YmOZdgkSI:en7/pu/4hC/4FuCaX0oiu/HPVmgkS
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule sample agile_net -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Orqur.exe
Files
-
Orqur.exe.exe windows:4 windows x64 arch:x64
Password: 123
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.niga0 Size: - Virtual size: 158KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.niga1 Size: 8.8MB - Virtual size: 8.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ