OrcusRAT1.9.1.zip
- SHA256 7753de049d1607a1a5f9686b1d41a6093c7f163742edd9d71e47e76523a3d2f8
Overview
overview
10Static
static
10Orcus RAT ...on.exe
windows7-x64
3Orcus RAT ...on.exe
windows10-2004-x64
3Orcus RAT ...ow.dll
windows7-x64
1Orcus RAT ...ow.dll
windows10-2004-x64
1Orcus RAT ...eo.dll
windows7-x64
1Orcus RAT ...eo.dll
windows10-2004-x64
1Orcus RAT ...ox.dll
windows7-x64
1Orcus RAT ...ox.dll
windows10-2004-x64
1Orcus RAT ...re.dll
windows7-x64
1Orcus RAT ...re.dll
windows10-2004-x64
1Orcus RAT ...Ex.dll
windows7-x64
1Orcus RAT ...Ex.dll
windows10-2004-x64
1Orcus RAT ...Ex.dll
windows7-x64
1Orcus RAT ...Ex.dll
windows10-2004-x64
1Orcus RAT ...ed.dll
windows7-x64
1Orcus RAT ...ed.dll
windows10-2004-x64
1Orcus RAT ...ed.dll
windows7-x64
1Orcus RAT ...ed.dll
windows10-2004-x64
1Orcus RAT ...er.dll
windows7-x64
1Orcus RAT ...er.dll
windows10-2004-x64
1Orcus RAT ...op.dll
windows7-x64
1Orcus RAT ...op.dll
windows10-2004-x64
1Orcus RAT ...it.dll
windows7-x64
1Orcus RAT ...it.dll
windows10-2004-x64
1Orcus RAT ...ib.dll
windows7-x64
1Orcus RAT ...ib.dll
windows10-2004-x64
1Orcus RAT ...rk.dll
windows7-x64
1Orcus RAT ...rk.dll
windows10-2004-x64
1Orcus RAT ...al.dll
windows7-x64
1Orcus RAT ...al.dll
windows10-2004-x64
1Orcus RAT ...ro.dll
windows7-x64
1Orcus RAT ...ro.dll
windows10-2004-x64
1Behavioral task
behavioral1
Sample
Orcus RAT 1.9.1/Orcus.Administration/Orcus.Administration.exe
Resource
win7-20240729-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Orcus RAT 1.9.1/Orcus.Administration/Orcus.Administration.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
Orcus RAT 1.9.1/Orcus.Administration/libraries/AForge.Video.DirectShow.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Orcus RAT 1.9.1/Orcus.Administration/libraries/AForge.Video.DirectShow.dll
Resource
win10v2004-20250313-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Orcus RAT 1.9.1/Orcus.Administration/libraries/AForge.Video.dll
Resource
win7-20250207-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Orcus RAT 1.9.1/Orcus.Administration/libraries/AForge.Video.dll
Resource
win10v2004-20250313-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Orcus RAT 1.9.1/Orcus.Administration/libraries/Be.Windows.Forms.HexBox.dll
Resource
win7-20241010-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Orcus RAT 1.9.1/Orcus.Administration/libraries/Be.Windows.Forms.HexBox.dll
Resource
win10v2004-20250314-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Orcus RAT 1.9.1/Orcus.Administration/libraries/CSCore.dll
Resource
win7-20241023-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Orcus RAT 1.9.1/Orcus.Administration/libraries/CSCore.dll
Resource
win10v2004-20250314-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
Orcus RAT 1.9.1/Orcus.Administration/libraries/ControlzEx.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
Orcus RAT 1.9.1/Orcus.Administration/libraries/ControlzEx.dll
Resource
win10v2004-20250314-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
Orcus RAT 1.9.1/Orcus.Administration/libraries/DirectoryInfoEx.dll
Resource
win7-20241010-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
Orcus RAT 1.9.1/Orcus.Administration/libraries/DirectoryInfoEx.dll
Resource
win10v2004-20250314-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
Orcus RAT 1.9.1/Orcus.Administration/libraries/Exceptionless.Signed.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
Orcus RAT 1.9.1/Orcus.Administration/libraries/Exceptionless.Signed.dll
Resource
win10v2004-20250314-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
Orcus RAT 1.9.1/Orcus.Administration/libraries/Exceptionless.Wpf.Signed.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
Orcus RAT 1.9.1/Orcus.Administration/libraries/Exceptionless.Wpf.Signed.dll
Resource
win10v2004-20250314-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
Orcus RAT 1.9.1/Orcus.Administration/libraries/FluentCommandLineParser.dll
Resource
win7-20241010-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
Orcus RAT 1.9.1/Orcus.Administration/libraries/FluentCommandLineParser.dll
Resource
win10v2004-20250314-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
Orcus RAT 1.9.1/Orcus.Administration/libraries/GongSolutions.WPF.DragDrop.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
Orcus RAT 1.9.1/Orcus.Administration/libraries/GongSolutions.WPF.DragDrop.dll
Resource
win10v2004-20250314-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
Orcus RAT 1.9.1/Orcus.Administration/libraries/ICSharpCode.AvalonEdit.dll
Resource
win7-20250207-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
Orcus RAT 1.9.1/Orcus.Administration/libraries/ICSharpCode.AvalonEdit.dll
Resource
win10v2004-20250314-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
Orcus RAT 1.9.1/Orcus.Administration/libraries/ICSharpCode.SharpZipLib.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
Orcus RAT 1.9.1/Orcus.Administration/libraries/ICSharpCode.SharpZipLib.dll
Resource
win10v2004-20250313-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
Orcus RAT 1.9.1/Orcus.Administration/libraries/Lidgren.Network.dll
Resource
win7-20240729-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
Orcus RAT 1.9.1/Orcus.Administration/libraries/Lidgren.Network.dll
Resource
win10v2004-20250314-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
Orcus RAT 1.9.1/Orcus.Administration/libraries/MahApps.Metro.IconPacks.Material.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
Orcus RAT 1.9.1/Orcus.Administration/libraries/MahApps.Metro.IconPacks.Material.dll
Resource
win10v2004-20250314-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
Orcus RAT 1.9.1/Orcus.Administration/libraries/MahApps.Metro.dll
Resource
win7-20241023-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
Orcus RAT 1.9.1/Orcus.Administration/libraries/MahApps.Metro.dll
Resource
win10v2004-20250314-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target OrcusRAT1.9.1.zip
- Size 22.7MB
- Sample250328-bchj4ssl16
- SHA256 7753de049d1607a1a5f9686b1d41a6093c7f163742edd9d71e47e76523a3d2f8
- MD5 16d89509da82189fed1a8a2649d2a168
- SHA1 fd8d57cae1952adf0e70d40e57802fb70b9aac3c
- SHA512 ec9c7485123183731385bcfc0a247d400588d310a6ec981123fa2e883073ef7b8f1d5f835e31a995b1c010ebea4a6e882038f8e341d6bbc9676952c0dd96d03c
- SSDEEP 393216:7zO42vwWQW21/wnn//z8AzU6JvPSBQVEjRoG55998AEuFfIReyDAEjR4:vz2gbgX7/jq1oG5L98AvnM14
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Orcurs Rat Executable 1 IoCs
resource yara_rule static1/unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/Orcus.Administration.Resources.dll orcus - Orcus family
- Unsigned PE 54 IoCs
Checks for missing Authenticode signature.
resource unpack001/Orcus RAT 1.9.1/Orcus.Administration/Orcus.Administration.exe unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/AForge.Video.DirectShow.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/AForge.Video.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/Be.Windows.Forms.HexBox.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/CSCore.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/ControlzEx.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/DirectoryInfoEx.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/Exceptionless.Signed.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/Exceptionless.Wpf.Signed.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/FluentCommandLineParser.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/ICSharpCode.AvalonEdit.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/ICSharpCode.SharpZipLib.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/Lidgren.Network.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/MahApps.Metro.IconPacks.Material.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/MahApps.Metro.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/Mono.Cecil.Mdb.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/Mono.Cecil.Rocks.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/Mono.Cecil.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/NLog.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/Ookii.Dialogs.Wpf.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/OpusWrapper.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/Orcus.Administration.Commands.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/Orcus.Administration.Core.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/Orcus.Administration.FileExplorer.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/Orcus.Administration.Plugins.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/Orcus.Administration.Resources.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/Orcus.Administration.ViewModels.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/Orcus.Plugins.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/Orcus.Shared.Utilities.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/Orcus.Shared.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/Orcus.StaticCommands.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/OxyPlot.Wpf.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/OxyPlot.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/SharpDX.DXGI.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/SharpDX.Direct3D11.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/SharpDX.Direct3D9.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/SharpDX.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/ShellLibrary.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/Sorzus.Wpf.Toolkit.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/Sparrow.Chart.Wpf.40.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/TurboJpegWrapper.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/Vestris.ResourceLib.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/WriteableBitmapEx.Wpf.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/Xceed.Wpf.AvalonDock.Themes.Aero.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/Xceed.Wpf.AvalonDock.Themes.Metro.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/Xceed.Wpf.AvalonDock.Themes.VS2010.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/Xceed.Wpf.AvalonDock.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/Xceed.Wpf.Toolkit.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/nUpdate.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/sqlite3.dll unpack001/Orcus RAT 1.9.1/Orcus.Administration/libraries/starksoft.aspen.dll unpack001/Orcus RAT 1.9.1/Orcus.Server.CommandLine/Orcus.Server.CommandLine.exe unpack001/Orcus RAT 1.9.1/Orcus.Server.CommandLine/sqlite3.dll unpack001/Orcus RAT 1.9.1/Orcus.Server/Orcus.Server.exe
File Explorer
-
OrcusRAT1.9.1.zip.zip 22.7MB
-
Orcus RAT 1.9.1/Orcus.Administration/Orcus.Administration.exe.exe 3.9MB
-
Orcus RAT 1.9.1/Orcus.Administration/Orcus.Administration.exe.config1KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/AForge.Video.DirectShow.dll.dll 60KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/AForge.Video.dll.dll 20KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/Be.Windows.Forms.HexBox.dll.dll 84KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/CSCore.dll.dll 519KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/ControlzEx.dll.dll 176KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/DirectoryInfoEx.dll.dll 225KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/Exceptionless.Signed.dll.dll 734KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/Exceptionless.Wpf.Signed.dll.dll 26KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/FluentCommandLineParser.dll.dll 43KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/GongSolutions.WPF.DragDrop.dll.dll 108KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/ICSharpCode.AvalonEdit.dll.dll 605KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/ICSharpCode.SharpZipLib.dll.dll 196KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/Lidgren.Network.dll.dll 117KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/MahApps.Metro.IconPacks.Material.dll.dll 1.1MB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/MahApps.Metro.dll.dll 1.0MB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/Microsoft.Threading.Tasks.dll.dll 36KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/Mono.Cecil.Mdb.dll.dll 42KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/Mono.Cecil.Rocks.dll.dll 27KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/Mono.Cecil.dll.dll 350KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/NLog.config.xml 1KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/NLog.dll.dll 858KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/Newtonsoft.Json.dll.dll 685KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/Ookii.Dialogs.Wpf.dll.dll 103KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/OpusWrapper.dll.dll 844KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/Orcus.Administration.Commands.dll.dll 173KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/Orcus.Administration.Core.dll.dll 178KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/Orcus.Administration.Core.dll.config707B
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/Orcus.Administration.FileExplorer.dll.dll 108KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/Orcus.Administration.Plugins.dll.dll 36KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/Orcus.Administration.Resources.dll.dll 13.2MB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/Orcus.Administration.ViewModels.dll.dll 514KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/Orcus.Administration.ViewModels.dll.config969B
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/Orcus.Plugins.dll.dll 31KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/Orcus.Shared.Utilities.dll.dll 48KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/Orcus.Shared.dll.dll 343KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/Orcus.StaticCommands.dll.dll 71KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/OxyPlot.Wpf.dll.dll 157KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/OxyPlot.dll.dll 536KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/SharpDX.DXGI.dll.dll 125KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/SharpDX.Direct3D11.dll.dll 271KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/SharpDX.Direct3D9.dll.dll 338KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/SharpDX.dll.dll 247KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/ShellLibrary.dll.dll 64KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/Sorzus.Wpf.Toolkit.dll.dll 54KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/Sparrow.Chart.Wpf.40.dll.dll 132KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/System.Windows.Interactivity.dll.dll 54KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/TurboJpegWrapper.dll.dll 1.3MB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/Vestris.ResourceLib.dll.dll 76KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/WriteableBitmapEx.Wpf.dll.dll 55KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/Xceed.Wpf.AvalonDock.Themes.Aero.dll.dll 85KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/Xceed.Wpf.AvalonDock.Themes.Metro.dll.dll 77KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/Xceed.Wpf.AvalonDock.Themes.VS2010.dll.dll 82KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/Xceed.Wpf.AvalonDock.dll.dll 436KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/Xceed.Wpf.Toolkit.dll.dll 1.1MB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/nUpdate.dll.dll 2.6MB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/nUpdate.dll.config1KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/sqlite3.dll.dll 626KB
-
Orcus RAT 1.9.1/Orcus.Administration/libraries/starksoft.aspen.dll.dll 48KB
-
Orcus RAT 1.9.1/Orcus.Server.CommandLine/NLog.config.xml 1KB
-
Orcus RAT 1.9.1/Orcus.Server.CommandLine/Orcus.Server.CommandLine.exe.exe 1.7MB
-
Orcus RAT 1.9.1/Orcus.Server.CommandLine/Orcus.Server.CommandLine.exe.config.xml 175B
-
Orcus RAT 1.9.1/Orcus.Server.CommandLine/sqlite3.dll.dll 626KB
-
Orcus RAT 1.9.1/Orcus.Server/Orcus.Server.exe.exe 2.9MB
-
Orcus RAT 1.9.1/Orcus.Server/Orcus.Server.exe.config.xml 175B
Orcus RAT 1.9.1/Orcus.Administration/Orcus.Administration.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0121f2d7ddc074ffa05619dbb2a4b555a4b550168a765b57fa8bd9298a7e4b52
- MD5 37349777df1cc9c8d3d62eb733f7cd45
- SHA1 456233fa947ab155dbe5636eda0a77346197bb4c
- SHA512 ca4e1a39dbb0fa0c6bbef7142cf457856cc2db14c03b5b9ea5c28811a3a70cc05505320f50e133e166aad25d779ac043b0f29b09bb34a342f5111603cc5dd074
- SSDEEP 49152:VZV/t1QLjeVxAl40NVANW8cyTXTG1H66VbTWnepAl4:VZVDVxAl40NG48cyTKjVbTWnepAl4
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3985890
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\Orcus-1.9.1-src\Orcus-1.9.1-src\Orcus.Administration\obj\Release\Orcus.Administration.pdb
mscoree
_CorExeMain
Name
.text
Size
3.8MB
Virtual Size
3.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
145KB
Virtual Size
145KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/Orcus.Administration.exe.config
- SHA256 68695bcf02c26a74171ec14cc02d02ee545b5b55e24ff20b7f8068cf3d8cf37b
- MD5 4cb71dfe2b8d53eda709ba19c03f5b81
- SHA1 b116144704ef60e5c54e02973be4133108d5e513
- SHA512 57e596051ab0daf22f4d9b63091223456bb6c82d66a2774401f9dccbf02983752e7afef150b6ff3f18ebde68ed2bb5d04ee3326bbfc28f74b0f43daf0733661b
- MD5 SHA1 SHA512
Orcus RAT 1.9.1/Orcus.Administration/libraries/AForge.Video.DirectShow.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 666d44798d94eafa1ed21af79e9bc0293ffd96f863ab5d87f78bcee9ef9ffd6b
- MD5 17ed442e8485ac3f7dc5b3c089654a61
- SHA1 d3a17c1fdd6d54951141053f88bf8238dea0b937
- SHA512 9118bf11760354e9971ae8b27f7f6a405e46145b39ca6e6b413cb2e729e51304b895965e9140f66c9e3ef7caa4f344762bf059688b23dd32e4c2df271394fea2
- SSDEEP 1536:XwumrikcyTpOKVi+Dqp6viPUCcvKWz3NTpAK+7KI4v8U:6dOKViKa6pOWbhpAKyKIVU
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
67246
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\Andrew\AForge.NET\trunk\Sources\Video.DirectShow\obj\Release\AForge.Video.DirectShow.pdb
mscoree
_CorDllMain
Name
.text
Size
58KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/AForge.Video.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bafa6ed04ca2782270074127a0498dde022c2a9f4096c6bb2b8e3c08bb3d404d
- MD5 0bd34aa29c7ea4181900797395a6da78
- SHA1 ddffdcef29daddc36ca7d8ae2c8e01c1c8bb23a8
- SHA512 a3734660c0aba1c2b27ab55f9e578371b56c82754a3b7cfd01e68c88967c8dada8d202260220831f1d1039a5a35bd1a67624398e689702481ac056d1c1ddcdb0
- SSDEEP 384:Wu9f/hWFwLX+WJ7gfZLTswhHDlOdKaCxkyf0l:HfpZL9uxE9Cxd8l
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
26670
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\Andrew\AForge.NET\trunk\Sources\Video\obj\Release\AForge.Video.pdb
mscoree
_CorDllMain
Name
.text
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
848B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/Be.Windows.Forms.HexBox.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4938a4dbb51fd8d35dfdf2c5d42e9a127b9365d495461864e6bb9ec7fc9a3cb7
- MD5 1abb997d4e809b9d7f9016617dc01294
- SHA1 b249037720e408128e6559d02a7a8772db6d4438
- SHA512 c943a9ad6cfde82fb3e30bffd96006b4524e3c9348da66fd461be44e8e093afbe58d9da121494d9e557b1fd052413e651e5d1c549f8508e5061640818d895b1a
- SSDEEP 1536:vOo386x64hWu/19AQhZRxZJhn1fHJ1Y4eXrEBKsC5FfCf3vb7kn7kTXkF5Gj5qRQ:z38BEzAh5Cf/4t/0hoWp
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
81134
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
72KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/CSCore.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e835139171eb0d63b6b4e02b0997cac040c02d295648a275d4c8d28b234c8e94
- MD5 94a312a6fcec0e78808bcea3d8ff67f5
- SHA1 fe760487d13f9a6f5f359036561105d4aca88a1f
- SHA512 ecdedeee1ee4e35e4fbd2dea3a4dd8b0805166a9610a63affbfb673f2644588eacecba6b3a5a0052c202ab14c321800997512abc318d36a50b00cc86dc83ec1c
- SSDEEP 6144:qTOLDSWi9it6YQSJpAJNSgwB4dIiZsxFrRz0JfBT8hVNuNdrmh4K:oa2WR/YOBIORIJf84K
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
538286
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
518KB
Virtual Size
517KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/ControlzEx.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 241cb77017dc48e7cfac4bfbd005abb66432b9f4bf8cfd4f819b628d90f97fe0
- MD5 952ae691d9f17599a521b2d04aceeb46
- SHA1 55e0fa225c6fac6f25b28fd67ef844283d96c9c0
- SHA512 53246224c9fd54ba6bd61f204aaa166b1431a4bde53b5b6ef48ccd7fc90ac3a9ddf5f5ad74deb730dcb315d03794ed416a5448550ceda175662a49ea0b5c3d02
- SSDEEP 3072:FwkXm5RYe8R9HFif0ABkS9p+dFtp04M9Y8B3UVk7pq7F0E7:GYBL6p9pwFtppM9Y81Sk7pq7F0E
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
185410
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\controlzex\src\ControlzEx\obj\Release\NET462\ControlzEx.pdb
mscoree
_CorDllMain
Name
.text
Size
173KB
Virtual Size
173KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/DirectoryInfoEx.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 442c0fee392d42a5f81444aae38446290bb8dc90c9256e62bce9e95e9a9a8202
- MD5 87bd229e9b3944bff401157729c17427
- SHA1 42a05e867fc7bdcc51b7e1e7e06806952dd8dcd8
- SHA512 52205a55c8cda293f55cc0626f1ee594e0ceca770f3392b3758cdd9d710f1355de6fb6d3fafe36cf16f7dddeb518ace6cd4c95eaa74a0762742305316c7a9f52
- SSDEEP 6144:jlxNNy5JVVvc70yK1P7QrbvyOfXnwccMTLfPPGHcQX3vHXnX/WhXfr4sJvJQcd47:5xe5JVVkNKBgvyOfXnwccMTLfPPGHcQ/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
234102
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\Orcus-1.9.1-src\Orcus-1.9.1-src\Libraries\DirectoryInfoEx\obj\Release\DirectoryInfoEx.pdb
mscoree
_CorDllMain
Name
.text
Size
223KB
Virtual Size
222KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
996B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/Exceptionless.Signed.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 57b7be985c0b4630b8ca581e978e88671ae5912d06807891edd1d10e552d3765
- MD5 4787a519cfd30d7a7687ee62de7d8a47
- SHA1 9f9213692517aaa331ab0622e24b9458f483e95e
- SHA512 c74f7f4396082ab6f245ac7fcc61161cbc5582464bc78b3cf42deb08f9e44304568f462753b5c25122bcac4f58e766594426f7ff044d14c7b17f24825d3109d0
- SSDEEP 12288:SIKYlJjYbqxA6eWYHSpim8bVNVJIdUMhik5Kp5dBHLrVr4JOQ:l9a6erSpim8ZNVJI6x5dBHLrVr4JOQ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
756494
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\exceptionless-net\src\Exceptionless.Signed\obj\Release\net45\Exceptionless.Signed.pdb
mscoree
_CorDllMain
Name
.text
Size
731KB
Virtual Size
731KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/Exceptionless.Wpf.Signed.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 60cc0b13a13be7b36f2e1637b4d8f7f64ccef198bb258b318fde9c2810ac2447
- MD5 1b3a319b40f7cf78253d79ce3b8c0d42
- SHA1 23b6d076946967e4921f97e024ed68b72cbfbe3b
- SHA512 48ab69135c9f8c54eaf2c7b561ebf475d2a61e5911bcdf469b777f3bdea3d04697805fe09de7f81d57466e0904d2b625c7a1fd35e07f574c70ac70a6d486faf2
- SSDEEP 384:4foIgJjjnB13YuPwfkaNOAsL6L5vGLxrZfvTOtDTjzImcOFz/Ym1T9yQT0B0Am9B:4foZjjBJiLxkOtDbcsz/9NVGZBw7
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
31754
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\exceptionless-net\src\Platforms\Exceptionless.Wpf\obj\Release\Exceptionless.Wpf.Signed.pdb
mscoree
_CorDllMain
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/FluentCommandLineParser.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e6124423367a9ec411176e2714c16a041c1a8b3e1691845040b57b0d779bef14
- MD5 d0220eb32a8a631ca29f55929c7046cb
- SHA1 553ec4ecc90676c7bb1de9f75a6b1226f39677aa
- SHA512 63c2d7ac019d511751c57153bde64c5c57819a74ffbd1a893ea980211185296f018bc09980537394bb33e92508b4e14d87da8a6fba2ca87b820b9276d07a3445
- SSDEEP 768:/WDesbk1hc+zloHIC/+9LXPnnx+N8iRnFidzsREmm:eDejkc9LnAzaIRS
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
49310
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
z:\Builds\work\23f7f5f0221f789c\FluentCommandLineParser\obj\release\FluentCommandLineParser.pdb
mscoree
_CorDllMain
Name
.text
Size
40KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/GongSolutions.WPF.DragDrop.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 abb63fdf8125a59096918778e4c1f9afdac3fe08b37c700895bfafdd8b63abfc
- MD5 31c8b0fc79d9ec1b1cd4e57ce74c3560
- SHA1 feb1663c85da937fa94d6ec0f1c1d96b3b1c0496
- SHA512 b8280877af5c1b9a925abb4cf562003a82d8cdd9a84b5c76a456b5439b7b59c826aeac4ea9c84c8e37a8d37ed53f48334ecf23eb31bc31cd2fe3086379a8f70e
- SSDEEP 3072:QzxuS44j1DkuoIHuFDLe4OThhOFLHyDkiEo+jK7G:QES4wNS/sXOFLHyDkiujK7
- MD5 SHA1 SHA512 SSDEEP
Digest
5c:39:46:32:94:5d:48:63:7b:f7:4e:20:cb:6d:d6:30:9a:80:b0:ef:13:ea:61:97:6a:72:c7:c2:c2:b7:b6:f5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Jan Karger,O=Jan Karger,L=Alsdorf,C=DE
Chains
Jan 29, 2022
CN=Jan Karger,O=Jan Karger,L=Alsdorf,C=DE
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=Jan Karger,O=Jan Karger,L=Alsdorf,C=DE
Serial Number
0d:9b:cf:d1:9f:2f:ba:2c:ad:56:ae:1a:d8:62:40:04
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 26, 2021 - Mar 22, 2022
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
108346
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/GongSolutions.WPF.DragDrop/obj/Release/net48/GongSolutions.WPF.DragDrop.pdb
mscoree
_CorDllMain
Name
.text
Size
98KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/ICSharpCode.AvalonEdit.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 941d014ff2689248704b92e4de92bc7a6015a4fcd31dec426ef2d727acc04231
- MD5 8f36b03d547fb3e0f9654d4f3074b89f
- SHA1 efa7dc54a626c20cbaec3b19b517a2ab64ac6e63
- SHA512 27c3020357d19a1498fff8c70d86e501b2b691a179fcf82d4590f371df6130157e7a88c97d5d22c9dcebd4d94af54d2aff90bb12589b88e6b65f3f50e9067509
- SSDEEP 6144:kiYcovb1WrZKNhU7nMjaR6dmnItzdSdoO+MSHMb5RKs8rvD288LPnM+k3XjXAUiW:kPcovbRon6cSEKvrvS88Lf1ltm
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
624790
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\AvalonEdit\AvalonEdit\ICSharpCode.AvalonEdit\obj\Release\net45\ICSharpCode.AvalonEdit.pdb
mscoree
_CorDllMain
Name
.text
Size
602KB
Virtual Size
602KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/ICSharpCode.SharpZipLib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 40b3d590f95191f3e33e5d00e534fa40f823d9b1bb2a9afe05f139c4e0a3af8d
- MD5 c8164876b6f66616d68387443621510c
- SHA1 7a9df9c25d49690b6a3c451607d311a866b131f4
- SHA512 44a6accc70c312a16d0e533d3287e380997c5e5d610dbeaa14b2dbb5567f2c41253b895c9817ecd96c85d286795bbe6ab35fd2352fddd9d191669a2fb0774bc4
- SSDEEP 3072:hjMibqfQqFyGCDXiW9Pp/+Tl4abpuu201PB1BBXIDwtqSPVINrAfvp1:GibqI59PpOPf201/z7p
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
196446
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
184KB
Virtual Size
183KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/Lidgren.Network.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bf9948c27bd2947a42ea51ccc63b93f2b9030bd117393e1d7637a5770b9b0776
- MD5 a6fdc03e2cbdfa9d393512606097a1ff
- SHA1 c63933c082d282a284250deceb51d0d300647fe7
- SHA512 2ec59fd17cd34741ab8d0ef0d8ef3533ef38b03e98d65bb1a19940349b16e47142b0d407946cb05bfc63d7859c1472c0906a72be0e1dcee0c170b80270ad6ca2
- SSDEEP 3072:vmwfq+PlFS1gh72NkCM9eu3JcCDMFfXZkHhKQ6u80y8/ko1r8ApI9G:uaVh7CTu3iI/NJe
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
125602
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Dokumente\GitHub\lidgren-network-gen3\Lidgren.Network\obj\Release\Lidgren.Network.pdb
mscoree
_CorDllMain
Name
.text
Size
115KB
Virtual Size
114KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
960B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/MahApps.Metro.IconPacks.Material.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 97f4ca8c89ee13b8c249ca6f929d067ba3e87be07b4afa372fdc0a7e9e6e78e1
- MD5 d8e627aadfb6dfed292be0672faa9f15
- SHA1 2a7f51711bffd75ecb2d7ff2f510c89eecd16366
- SHA512 d5139830d367a29e76ca260d9b17955cff80f1779c157551642f7e13d9abd265335ba0bbda433e8898042d482f29d79c48683fede4b8af746b69a7dfcd02098c
- SSDEEP 6144:z40kYmQYwygR8Vi3vTZ20kuCcrY5eakqF09HfnmnygreJrextoqQpddv0dxHde:MpYm
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1209194
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\Downloads\MahApps.Metro.IconPacks-dev\MahApps.Metro.IconPacks-dev\src\MahApps.Metro.IconPacks.Material\obj\Release_NET46\MahApps.Metro.IconPacks.Material.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/MahApps.Metro.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1af18a7eae467706f699dea9fcade9635ea2e331737501b72910413dfb12f17c
- MD5 735bea953b819dc0874176355e3e3141
- SHA1 8ff71613230d454ec27d7b7ee6795289751a5277
- SHA512 2963d60fd6c182fa01b62ada3894987ba34f317b5c0cb92905a92930d68a6eeca5f4511d3d36a4ed4a0c3e3851f3ca16683ce9e8d98567f8cc206b973fee5148
- SSDEEP 12288:3EAVRt0dmk6GmfvE4v4ICwQGZDHSxV/INvHG:3EAVRtOB6Gy/v4ICwQGZDHSxV/wvHG
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1102522
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\mahapps-metro\src\MahApps.Metro\obj\Release\net47\MahApps.Metro.pdb
mscoree
_CorDllMain
Name
.text
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/Microsoft.Threading.Tasks.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5f29e16edff5379e93d5be9bee4cddf98132b84326027688511ac0f3157aaf94
- MD5 d01819bfe03222dfa9e35a36555b6b6c
- SHA1 25f8069590b14724f28e6a04b8a42e4ef4a8562d
- SHA512 e63901f39315972e446768f2c14b4279cf1dd382f97ac90c444c4d858c2a486736a259c47245026b11e5c0846310e7da020bf2466ea91aa0a15d22cb67b37477
- SSDEEP 384:AjCan21RTf1FuPIgbSVHfiWvoVZHL+8SChE+QNEv4USWyWcWZ1q//0GftpBjfuHk:A+e21RTrgbSpfihdvF4eg8iUHWTmlr+
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
b1:13:00:5b:36:13:ce:2f:23:c6:0d:0b:cf:75:20:94:18:94:2e:63:26:8a:ed:9d:e5:a9:f6:b2:54:92:bf:6a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 26, 2025
PE Signature issue
Digest
8a:50:28:53:0d:ab:5d:2d:e6:72:c7:e9:b0:73:fe:e5:94:2c:a4:f8
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 7, 2014
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 27, 2013 - Jun 27, 2014
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 24, 2013 - Apr 24, 2014
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 24, 2013 - Dec 24, 2014
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
26462
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\b\4741\2597\src\intermediate\Microsoft.Threading.Tasks.csproj_97b2926c\Release\Microsoft.Threading.Tasks.pdb
mscoree
_CorDllMain
Name
.text
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/Mono.Cecil.Mdb.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 411f8ed8c49738fa38a56ed8f991d556227d13602e83186e66ae1c4f821c940b
- MD5 1c6aca0f1b1fa1661fc1e43c79334f7c
- SHA1 ec0f591a6d12e1ea7dc8714ec7e5ad7a04ef455d
- SHA512 1c59e939d108f15881d29fe4ced4e5fa4a4476394b58b6eb464da77192cb8fe9221b7cd780af4596914d4cce7c3fc53f1bb567f944c58829de8efbe1fd87be76
- SSDEEP 768:Ar5EYZep98C87KHeBUZwrEzsEAnbF+em50KktmM4CRIcZwMRTIzMAtpw:Ar59g98C87KHeBUb5AnZG+zdwMRTzAtS
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
49118
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\src\cecil\symbols\mdb\obj\Release\net40\Mono.Cecil.Mdb.pdb
mscoree
_CorDllMain
Name
.text
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/Mono.Cecil.Rocks.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2e2623319bdc362974a78ea4a43f4893011ec257884d24267f4594142fcd436e
- MD5 6e7f0f4fff6c49e3f66127c23b7f1a53
- SHA1 14a529f8c7ee9f002d1e93dcf8ff158ab74c7e1a
- SHA512 0c773da6717dd6919cd6241d3cee26ab00bb61ea2dbeff24844a067af4c87ff5cbdb2fe3ada5db4707cee921b3fb353bd12ee22b8490597d4f67ad39bace235e
- SSDEEP 384:70ve8JOuJ5iC7n2NwxEXCni+VXcMeDz8PmR1ugLoaeuLMBG9UphJAprjE3uFLHa9:7+m4iCyrXOhG8uRssveum1pMFLHFBvd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
33574
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\src\cecil\rocks\obj\Release\net40\Mono.Cecil.Rocks.pdb
mscoree
_CorDllMain
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/Mono.Cecil.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f66f97866433e688acc3e4cd1e6ef14505f81df6b26dd6215e376767f6f954bc
- MD5 de69bb29d6a9dfb615a90df3580d63b1
- SHA1 74446b4dcc146ce61e5216bf7efac186adf7849b
- SHA512 6e96a510966a4acbca900773d4409720b0771fede37f24431bf0d8b9c611eaa152ba05ee588bb17f796d7b8caaccc10534e7cc1c907c28ddfa54ac4ce3952015
- SSDEEP 6144:jIevdbLPNYe8bikm98KXPHhOWY/fFREomhUFD3z:se1PNL+QRfBg/f/EWFD
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
362022
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\src\cecil\obj\Release\net40\Mono.Cecil.pdb
mscoree
_CorDllMain
Name
.text
Size
348KB
Virtual Size
347KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/NLog.config
- SHA256 d56fbacf922973e0c0a1ffb4555c7a6fac9e0e121101bc564fdc4d22e4fef4fa
- MD5 eb612b6a71aead3c35e09b65b5102b1e
- SHA1 d1d6b3ac4a381feb026d80ceeb26d346af0e5e8f
- SHA512 0a95be9da59a3236f541c08f0c3434e0acf2b51a06be3b73f1f341e8c2b22fa1810c323bfb11233836737c07427792089b405c306298a0a9c986d0e120e4b6d3
- MD5 SHA1 SHA512
Orcus RAT 1.9.1/Orcus.Administration/libraries/NLog.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b651f56f8dba7c58cde9b434cc2efe0b4eaae8fab16d9b1c7ee5b91a2080a6e0
- MD5 f3ed19332c888fbf1ff6dd67f1c2f14c
- SHA1 2c7ac97bc63ff5a8c24aa5a8de1ee65ee60f1da9
- SHA512 edaad1af30c35b1a02a6e735347f84bb82264e8e1309048b13cb50219818726627990803a70aff7bac65e65fd950386e2e659c31fb2484122d38fa99b85d7874
- SSDEEP 24576:QtVlTtN9vFtt9LIOK3AbsV59cxtqrHUsQ:QtVlTtN9vFtt9L2Iq
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
883482
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\nlog\src\NLog\obj\Release\net45\NLog.pdb
mscoree
_CorDllMain
Name
.text
Size
855KB
Virtual Size
854KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3
- MD5 081d9558bbb7adce142da153b2d5577a
- SHA1 7d0ad03fbda1c24f883116b940717e596073ae96
- SHA512 2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511
- SSDEEP 12288:U9BzaPm657wqehcZBLX+HK+kPJUQEKx07N0TCBGiBCjC0PDgM5j9FKjc3Q5:U8m657w6ZBLmkitKqBCjC0PDgM5A5
- MD5 SHA1 SHA512 SSDEEP
Digest
2e:83:93:14:a9:06:f5:64:04:02:a1:dc:eb:a3:1a:a7:e9:21:c8:88:2c:dd:c2:3c:e4:c0:45:50:4c:ee:75:10
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Chains
Mar 17, 2021
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Serial Number
07:b0:41:8d:a5:1e:14:8c:33:1b:bc:de:b7:13:83:23
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 27, 2018 - Apr 27, 2028
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Serial Number
0a:71:a1:b0:c2:96:f5:c7:90:65:47:0a:3c:20:53:7e
Issuer
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 25, 2018 - Oct 29, 2021
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
698886
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
675KB
Virtual Size
675KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/Ookii.Dialogs.Wpf.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 285aa8225732ddbcf211b1158bd6cff8bf3acbeeab69617f4be85862b7105ab5
- MD5 932ebb3f9e7113071c6a17818342b7cc
- SHA1 9ce2d08bc3840632092325abcc8d842eeb8189d4
- SHA512 6b6086cff7b916c0c4536e3c7cba4ba17d6c4be2e4a88a5877be852e197f1f9c9c120d1295acf2b4277a9badd8cfd229ef3c1ab2049d0aeec22d3033be156141
- SSDEEP 1536:qgoPBGuyAy52V+gtTLq6ZUc68h8O0SB/XBboIawHUPV5bKLh8sm6b0gl:qgwBGu2IV+ghd68WOxXBbx+5of
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
110858
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\ookii-dialogs-wpf\ookii-dialogs-wpf\src\Ookii.Dialogs.Wpf\obj\Release\net462\Ookii.Dialogs.Wpf.pdb
mscoree
_CorDllMain
Name
.text
Size
100KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/OpusWrapper.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a0a1613455bdea1634386023d7649309f1c293356be28135723f16928ee9d9f7
- MD5 decf3b1c5d63d710718bf9bad495aa33
- SHA1 d1f6585999858bca5b09496c85a81bd0ad9a6991
- SHA512 40c81099b6d6dda8d2a9d98e2e69457c11c0ae30d35f64c73345cb7e33b0e53ecc2fd27cc4f883650e2ac9231300cbda3e58d1245b2783acc03d7710b9dd80b5
- SSDEEP 12288:VbwskteKPwaLStzL8tkjzUwsksX7GSWYMl7oeQOSYIDbjclvQMrox:pIteKc58aQ7GSW9NHVOPjcl7r
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
869942
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\Orcus-1.9.1-src\Orcus-1.9.1-src\Libraries\OpusWrapper\obj\Release\OpusWrapper.pdb
mscoree
_CorDllMain
Name
.text
Size
842KB
Virtual Size
841KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/Orcus.Administration.Commands.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a3a71a6da39163149b412a887b318c3057f7805c4b6130c7edca990f9ffd2a1e
- MD5 69e0dfd535117851c2168f50649f33df
- SHA1 4843876c17c868370037fb9a9b781cc0c92cfcfa
- SHA512 ee5df74b934a5fd2eb23407cb8285133c437e620cdee5898f7d262d918d8a05e00a146dc169cec918af0d88fa72f8f028191d4e3ca51272d17960ee43d7407e3
- SSDEEP 1536:p4Fz9hmCoWt60zmXm3DCzxwyBH8KoC5OPHTTanq3eshxy5M7A0y6/ml0FdoLQDo:hImXm3IH8KoC5OPHTr3eqQ0IQDo
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
183254
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\Orcus-1.9.1-src\Orcus-1.9.1-src\Orcus.Administration.Commands\obj\Release\Orcus.Administration.Commands.pdb
mscoree
_CorDllMain
Name
.text
Size
171KB
Virtual Size
170KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/Orcus.Administration.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a07d8389c94715e50afd2c8f3fdbb85cea8bde59287fe45229a5de9466e9f213
- MD5 e6e085079b60c17970e27c29b42b385f
- SHA1 b8ced79a01cb8923d6661783a6b450233067ef31
- SHA512 815fdfe51da719b8368b866dd7b3079af7aa5b5ae35ca7c1ed9bf46ef4400ad4a740c8378c50a1b9a3919af3fe3fb3b549cd7f01a4f446d8057e9c87dbceed26
- SSDEEP 3072:P4SvOPMkAcIh/AxOIqZ4TJIJOD/VbxNz2FcjGYAcJZ9trF7QCaQRhhydopvD/W:1WPTIBAiZ4T+0DFJyYA2Z9trBQCawh/r
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
188114
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\Orcus-1.9.1-src\Orcus-1.9.1-src\Orcus.Administration.Core\obj\Release\Orcus.Administration.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
176KB
Virtual Size
175KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/Orcus.Administration.Core.dll.config
- SHA256 3b584233bab01fd199065d44fabc98ad21ed035cdffda01d32881c87c83676b2
- MD5 fb50507db46bb8a3a63faf0f9e613ec9
- SHA1 a529429a2f7a12eb98035eadfbedbb29fd8c76d3
- SHA512 22f3456b3ca14499304987998f7449b15b09b9e752bca1f13e0dbd13f49bf9c4326d1f4812619f1a82b04b2a14d4851285754900ccacb6e3c62cb3048de749ae
- MD5 SHA1 SHA512
Orcus RAT 1.9.1/Orcus.Administration/libraries/Orcus.Administration.FileExplorer.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6662e522614e1dc0ab28821c46f1089d77ef89d7ad3344e5b17ff26abd02b39b
- MD5 728e35ef717c82d62737b0ca48b71473
- SHA1 d023d823dbdd94fd1c7eebd47917d5568a289703
- SHA512 cf2cfb0e9a77b9dd2b97834e5b0d9767488700c21c57e00a4de4f56f86d70ad98a9343387281257ddefb32b77ab74df3dbff0ca74bb0c5bd51f6a082363c6112
- SSDEEP 1536:mr4d/N1tB/vg/0OXG1xXRUNEpB+tpHXT2uj2IF3RQWp35TJm7lBJO7Zxn7FU05lS:mr453/o/GPB5chj2eF3R5Jt7Zxn7Fz+
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
115838
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\Orcus-1.9.1-src\Orcus-1.9.1-src\Libraries\Orcus.Administration.FileExplorer\obj\Release\Orcus.Administration.FileExplorer.pdb
mscoree
_CorDllMain
Name
.text
Size
105KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/Orcus.Administration.Plugins.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 586b641ac8370d6d4214a25978e83e75d7609f1b671423f02afbe9f03e31d789
- MD5 7334117321d06d64d34e8fa394ece199
- SHA1 9c5825c517977a206469798e63988859841b9de8
- SHA512 3591dd9009209525c19163bf57da575cd5b66c90c30e8606153419d5673940aab9dff13a651bc39114b4acda07fadb85d9c0ae7b36ed434b92d460572cc75626
- SSDEEP 768:tex7Uk+2OtxAbEX74rYqH5KCJt7qixbv:iUz2OrEEL4Mq5HuSv
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
42810
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\Orcus-1.9.1-src\Orcus-1.9.1-src\Orcus.Administration.Plugins\obj\Release\Orcus.Administration.Plugins.pdb
mscoree
_CorDllMain
Name
.text
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/Orcus.Administration.Resources.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ad0882f9825e4e1e8ea4f5172fdfc20379243bc153cd5a85a44b2c7d64a7d5fd
- MD5 0e657f87405ed64fc36f23a8a21dbf62
- SHA1 87a4caf93401da28544e5e8a0abd880210b110b4
- SHA512 9c841df1fb472717c598588f961485b69b6c32bd0f9705d4feeb80c44de0cf80ad97838e08a81fb53a1135ef30b3ec83c288b5b498e4148273255c0a8878e9b3
- SSDEEP 196608:uP9Tpu5khY8v2wB3ys2uypSZ4JC28pCVmfZ9864ZCys2jmfZ986wniCys22+fx:nB8vz9zyS4JCxpC4fZ9UWbfZ9UX
- MD5 SHA1 SHA512 SSDEEP
-
Orcurs Rat Executable
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13809234
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\Orcus-1.9.1-src\Orcus-1.9.1-src\Orcus.Administration.Resources\obj\Release\Orcus.Administration.Resources.pdb
mscoree
_CorDllMain
Name
.text
Size
13.2MB
Virtual Size
13.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/Orcus.Administration.ViewModels.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 66639aff978b4cede656fc4c2e0b28a71df0f41a5d5f48e472da558752eab4e7
- MD5 b7bd85b0122ba17962b460a2fafc0811
- SHA1 74e7222586cd0cf56d011d263462f35699400c88
- SHA512 9335856828c2dfd329d238d4f9f0e9b2aa2d2192b808a4060c4f7a56a6f1c7e28c73cb0cc568cd77375c3af440b24d1c707985e4dea3f78ec97f68bf9531725e
- SSDEEP 6144:ISrNRrUEL4se/ZJwvGWsQPlh5ONfpjLuStk4JzKEcR8NKOWu3GWSJstVL:lNRrMscmGWr3UfFaMOhRKWTUL
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
532130
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\Orcus-1.9.1-src\Orcus-1.9.1-src\Orcus.Administration.ViewModels\obj\Release\Orcus.Administration.ViewModels.pdb
mscoree
_CorDllMain
Name
.text
Size
512KB
Virtual Size
511KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/Orcus.Administration.ViewModels.dll.config
- SHA256 49ffbeaced69a69955beb42d304e7aa0be357ac51cb13d1b1be3b2249beae7eb
- MD5 da034ac1d2b45c38d6d2fd4355b9227e
- SHA1 10b00514c2089a2d6376ab961ef107de25481d3c
- SHA512 dd4fe8500868dddaeb9d167e378eab868c3a1d7d620e1464dcec28f7272fbd8a034ec961f86407f7c09c30999811783082a4bae0b7daeaf16dfa86f5f8c35d45
- MD5 SHA1 SHA512
Orcus RAT 1.9.1/Orcus.Administration/libraries/Orcus.Plugins.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e2b10312165eb89bb9221f10908a7715eb0e12829d8f7991510b7373848489cd
- MD5 4080ce5546902a34b8ad7e2560138d8e
- SHA1 0df01a32bcf03e50d6f2f38d713fd291aaf13cc3
- SHA512 1ca529f628cee64bb2aa7fe1ef073ea6c09b8401ee27847a729dde8d744b28561fbc3e7dfeb6b2cbf6bb4b969f372c84eee70440ddd7ed7c2d51da96030ae8f0
- SSDEEP 768:Eq9CzWIysjcU83CDY3mVimzl3+vKu3cCxOl:S2T3kYWNzl3AKu3cCxOl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
37358
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\Orcus-1.9.1-src\Orcus-1.9.1-src\Orcus.Plugins\obj\Release\Orcus.Plugins.pdb
mscoree
_CorDllMain
Name
.text
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/Orcus.Shared.Utilities.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5453f3d2e18d8a8d9890c61bf2637d1c6ee220df5cc3b4a94706ccb3c984e2c1
- MD5 cfc5f2a2c3e42f165206fdef112a1248
- SHA1 7384146567495aa9f0b833dfe5f99c31e01ce673
- SHA512 b66771eff18bb6882bb2d43ce651ada8d2c554e46a49333acaf1e48d6d986e5a42bc707ca76cc2bbc94c8be7b16ffefbfa4244ddba69877175f2f0454b1555d8
- SSDEEP 768:5I3zZB3t3vAc9qetINLxzQ6zKzg+1SAODLAkOV5qX2KB929+9HkPnk+ud6Zx8A8l:5IL+/QFpEOqX2GkPn5vcTUDLY+TUDX
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
54754
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\Orcus-1.9.1-src\Orcus-1.9.1-src\Orcus.Shared.Utilities\obj\Release\Orcus.Shared.Utilities.pdb
mscoree
_CorDllMain
Name
.text
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/Orcus.Shared.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 467bd59c93132b339cc05974b7a9c4a8d4d5d2bcdd8df7631f98682195dd2011
- MD5 280c3f5f4c20bc4ce8adb25a27339dcb
- SHA1 1801063a265c89561caa205d28f8c52ca048f402
- SHA512 e6bc07bd9bcd40fe3d92d1844b760aac666da9a590b44b3fde34caeb91d59aa8a7e1589b6daa43178c7f72c3e9fbd19b7756b5b05feb1dd3c648f5c41d64e659
- SSDEEP 6144:M8UuovXvYd1dPxUri0hCwVgFVtQGfDNKJb8PyUblrt7m4Y:MnuwepP0hCw8tQGfoJbg3blJa4Y
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
356894
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\Orcus-1.9.1-src\Orcus-1.9.1-src\Orcus.Shared\obj\Release\Orcus.Shared.pdb
mscoree
_CorDllMain
Name
.text
Size
341KB
Virtual Size
340KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/Orcus.StaticCommands.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 78c787d49efa094cc4b972285d32994ee7b10d933a3f283b1a7119c2392373c9
- MD5 257696c0a5adf0d5c0caee9a177262aa
- SHA1 2163c29a7a6cbeb844886b8cb5fae9c3e10cf979
- SHA512 7dce964c5559c9dc4cd6f69547a61650a9b00f09bca1b52e8ba3c913e048e552e54f0ce824ad86fccc34c8ec1eacdc91371222d638045fda49608f2a4c1b9ab5
- SSDEEP 1536:6Wbzab+6x4F2p9bm5tNvIipLw1TcSUQ3L:1DF2p9b6Ngip01TcSUQb
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78070
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\Orcus-1.9.1-src\Orcus-1.9.1-src\Orcus.StaticCommands\obj\Release\Orcus.StaticCommands.pdb
mscoree
_CorDllMain
Name
.text
Size
68KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/OxyPlot.Wpf.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 212b0dcf8688c2a2092c7b605e973c98c5f67527832adad0aee459c79d182d2b
- MD5 9f8b251f09a2c14c18b52be6359b3bf6
- SHA1 1a498d7467a05aac25bbb2333b0730375a8ba8db
- SHA512 ab4efd8b56059870c4ae099e79782f3db7592f453d03ab1db6b6c2df52bbf2c4d04e2f0d2eb81604582bcbac433e700ea1345c9181455f8378db512bfa489bd6
- SSDEEP 3072:zO0czhby1/BLnIIUuAiF0onk8i8YXY5wdf9ZU5JZ55UxN4++E5D/FNcPyy7GK:Ce1/BDpUu7F0okmYXY5wdf9ZU5JZ55Ua
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
166370
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\oxyplot\Source\OxyPlot.Wpf\obj\Release\net45\OxyPlot.Wpf.pdb
mscoree
_CorDllMain
Name
.text
Size
154KB
Virtual Size
154KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/OxyPlot.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bcad0cfecc043843008b4af27d74e4cf46638a06e5d9d8a7b09ffab6e5829a98
- MD5 b5c0f9ea6d4d4c44172dc9d8770edd30
- SHA1 6f7c1a7175e3ebd1800fc6ced7fd03486434cb9e
- SHA512 83d199cc7cf1e4cd7167a6b11a045ce04d20b0f582008cde5344278651c5311dcb05a873dfd324c9601c13a0c2babd02f2f290df83445eb96ce869052083bc64
- SSDEEP 12288:SChVpNEAvA+FNFjnYSebof/sT8iG4shCbCgNP:SChVpNr2Sebof/s/G4eMCgN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
546902
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\oxyplot\Source\OxyPlot\obj\Release\net45\OxyPlot.pdb
mscoree
_CorDllMain
Name
.text
Size
534KB
Virtual Size
533KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/SharpDX.DXGI.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3762d43c83af69cd38c9341a927ca6bd00f6bae8217c874d693047d6df4705bf
- MD5 2b44c70c49b70d797fbb748158b5d9bb
- SHA1 93e00e6527e461c45c7868d14cf05c007e478081
- SHA512 faced62f6ecbfa2ee0d7a47e300302d23030d1f28758cbe9c442e9d8d4f8359c59088aa6237a28103e43d248c8efc7eeaf2c184028701b752df6cce92d6854d0
- SSDEEP 1536:taSL4xpOaI0PXSgMkPXsHIrPQkrNCivO5Ib6VU3x8w85SMxcnqNojG5JW/UlibAs:taSLYpfI0fTtP8HIbQkreK
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
134238
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\Downloads\SharpDX-3.1.0\SharpDX-3.1.0\Source\NET35\SharpDX.DXGI\bin\Release\SharpDX.DXGI.pdb
mscoree
_CorDllMain
Name
.text
Size
123KB
Virtual Size
123KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/SharpDX.Direct3D11.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d7617d926648849cbfef450b8f48e458ee52e2793fb2251a30094b778aa8848c
- MD5 98eb5ba5871acdeaebf3a3b0f64be449
- SHA1 c965284f60ef789b00b10b3df60ee682b4497de3
- SHA512 a60025e304713d333e4b82b2d0be28087950688b049c98d2db5910c00b8d45b92e16d25ac8a58ff1318de019de3a9a00c7cbf8a6ad4b5bb1cb175dafa1b9bea2
- SSDEEP 3072:6ccUvNf/AThDrcfiSDt0XN3ZDoyz91Sy0KwbwgG5OHDyGQsnHZ09K3vJqlQ1VcTS:zRfi+SmNgOHDyGQsucvJqW6Ts4dDjJZ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
283726
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\Downloads\desktop-duplication-net-master\desktop-duplication-net-master\libs\SharpDX.Direct3D11.pdb
mscoree
_CorDllMain
Name
.text
Size
269KB
Virtual Size
269KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/SharpDX.Direct3D9.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 02da4af8cd4a8de19d816000caaae885e676b9e52f136ff071a279c2b8ad34c7
- MD5 934da0e49208d0881c44fe19d5033840
- SHA1 a19c5a822e82e41752a08d3bd9110db19a8a5016
- SHA512 de62f629c2299b50af62893244a28895d63b78138c8632449984306f45de16bd01076eadbb0d75a700215e970c1df731e202ea640236c0f0da6ed15146193b59
- SSDEEP 6144:sF8TUNl4RaWH/EgJ2bOVbIbgiSC0EhS/:+8laWsgOOQHS
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
352142
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\Downloads\SharpDX-3.1.0\SharpDX-3.1.0\Source\NET35\SharpDX.Direct3D9\bin\Release\SharpDX.Direct3D9.pdb
mscoree
_CorDllMain
Name
.text
Size
336KB
Virtual Size
335KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/SharpDX.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 061542ff3fb36039b7bbffdf3e07b66176b264c1dfd834a14b09c08620717303
- MD5 ffb4b61cc11bec6d48226027c2c26704
- SHA1 fa8b9e344accbdc4dffa9b5d821d23f0716da29e
- SHA512 48aa6130bf1f5bd6de19256bbdf754c0158b43dd122cec47bb801a7a7b56f2da268bfdec24d135621764a23278ead3dcc35911a057e2dfa55a348bae8ef7b8a9
- SSDEEP 6144:/yx2FKVw+6LRnencMdWqtFhdpGFfnbJoeeYr:6w+Ienc1qf6bJrd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
258638
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\Downloads\SharpDX-3.1.0\SharpDX-3.1.0\Source\NET35\SharpDX\bin\Release\SharpDX.pdb
mscoree
_CorDllMain
Name
.text
Size
245KB
Virtual Size
244KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/ShellLibrary.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3feedd56e713a9cc723aff1dc6ff7e23240826958089dfe086dd406a8833b1ce
- MD5 241655712844de38318158bd4d16fbfe
- SHA1 2923f44a032676c03bc18fe1f6b96d919df5824d
- SHA512 fbad303a964b6801ba31746fb014f797a55ef4339a3f26935928ac11b4f91a7241bc4a8a63fe72afa5596850d8e3a482183aeae05dc5f4877552e5d30d35dcef
- SSDEEP 1536:9uxsMR2Voc5qep7+RnC+GYMqExmxEEYGie:9+m5B+PGYMnx16D
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
71946
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\Orcus-1.9.1-src\Orcus-1.9.1-src\Libraries\ShellLibrary\obj\Release\ShellLibrary.pdb
mscoree
_CorDllMain
Name
.text
Size
62KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/Sorzus.Wpf.Toolkit.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 55fe135dd15a03f74ad60cca5167a911cde4f816150ffd0ace28eb1aba647b19
- MD5 935ba6462b3715f47b15bcc01d06286b
- SHA1 c00cbdc225b3133abfb140458b0e549d423979af
- SHA512 1c3f85fc7370a6ca32f4324ad437d89f4a7a9910f19c41a88d8ae0bb92499c135ddce004c3f7095112b4407715f21be56f531563b82985b1ec7d0be50ca75723
- SSDEEP 1536:9rb6pm5GL6HE9x5RDi4Se5TTTTTTn3TTTTTTnnSpClLyjgF:9rFGCcJjlLDF
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
61042
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\Orcus-1.9.1-src\Orcus-1.9.1-src\Sorzus.Wpf.Toolkit\obj\Release\Sorzus.Wpf.Toolkit.pdb
mscoree
_CorDllMain
Name
.text
Size
52KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/Sparrow.Chart.Wpf.40.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d9f1d9ccc551e4befb208492b85231358c6bef50a5ad2ec1ab8d38a954873725
- MD5 218df16f7f5514e7f9350cb7949b2754
- SHA1 40b2c1d31473bca22bee2fc62dd1a1e8d54cf09b
- SHA512 7d83e3385ef4a2accaf8a5ace96e71ed739a9e1a8e73ae83b56ff2bb2f24252f95ce974fb49de4dde0fda7985ffd2db9512f2f1a292d7fbb88741508376eae08
- SSDEEP 3072:iMIZPtiKiPvtf8uHAV2uL1l3/9c3v3PstADQyHDhv0ZrETR/V:N02B3EtyQKNv0ZETR/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
140606
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
z:\Builds\work\bc49e9cff32877ae\Work\Source\Sparrow.Chart\WPF\obj\Release\Sparrow.Chart.Wpf.40.pdb
mscoree
_CorDllMain
Name
.text
Size
129KB
Virtual Size
129KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/System.Windows.Interactivity.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 93fbc59e4880afc9f136c3ac0976ada7f3faa7cacedce5c824b337cbca9d2ebf
- MD5 580244bc805220253a87196913eb3e5e
- SHA1 ce6c4c18cf638f980905b9cb6710ee1fa73bb397
- SHA512 2666b594f13ce9df2352d10a3d8836bf447eaf6a08da528b027436bb4affaad9cd5466b4337a3eaf7b41d3021016b53c5448c7a52c037708cae9501db89a73f0
- SSDEEP 1536:BYQaIZaEmaOQxn6JxKjtlMZAnuETAV+w4:aIhOQcSLAj4
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
3e:ee:d8:f6:58:e3:82:0a:29:a6:0d:4d:da:4f:ed:6b:c4:34:50:1b:a8:8c:42:82:1a:79:91:a0:3a:90:87:f2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 26, 2025
PE Signature issue
Digest
12:e5:b0:a2:ba:03:46:7f:56:92:05:89:ed:0e:65:b2:33:e9:07:1f
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 18, 2013
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:9d:1e:8d:27:ae:b8:f3:d8:38:00:01:00:00:00:9d
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 4, 2012 - Mar 4, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
45262
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
d:\ExprUpdate2\Blend\SDK\BlendWPFSDK\Build\Intermediate\Release\Libraries\System.Windows.Interactivity\System.Windows.Interactivity.pdb
mscoree
_CorDllMain
Name
.text
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/TurboJpegWrapper.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 047b042cebf4c851f0d14f85f16ce952f03e48c20362d4ed9390875d4900fe96
- MD5 ac6acc235ebef6374bed71b37e322874
- SHA1 a267baad59cd7352167636836bad4b971fcd6b6b
- SHA512 72ac8b8c8f27264cc261297c325d14a0be2084d007c6132ab8402d87f912fe9189cb074db11625d9f86d29a6188f22a89e58ae45c9131fac4522473567017081
- SSDEEP 24576:UgKP0yiaiCSZMaW+bChn+ibsE/SZvp46xJ62bgYTqr:NbI+iapR/Tqr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1368534
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Dokumente\GitHub\AS.TurboJpegWrapper\LibJpegWrapper\obj\Release\TurboJpegWrapper.pdb
mscoree
_CorDllMain
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/Vestris.ResourceLib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7da3f0e77c4dddc82df7c16c8c781fade599b7c91e3d32eefbce215b8f06b12a
- MD5 944ce5123c94c66a50376e7b37e3a6a6
- SHA1 a1936ac79c987a5ba47ca3d023f740401f73529b
- SHA512 4c034ff51cc01567f3cb0796575528ca44623b864eb606266bcf955a9259ed26b20bec0086d79038158d3a5af2ada0a90f59d7c6aae9e545294fe77825dbe08b
- SSDEEP 1536:CSSYikTF0Z+sFGu11tIcyI1MtI9eDG3fL7:CJYD0Z9FGu11teI1r9ea3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
83158
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\resourcelib\Source\ResourceLib\obj\Release\net45\Vestris.ResourceLib.pdb
mscoree
_CorDllMain
Name
.text
Size
73KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/WriteableBitmapEx.Wpf.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ab62ba930a6926b48cb4fe51c1a0555d576dce12cb2a08186722be2c60ee8210
- MD5 72ebed9fea40adaaf4b4589363d258ca
- SHA1 32913113135de691345524428c5ca37ee9b25a65
- SHA512 250c1858d1b8d00afedd9cb47b285607264c87549e95b40575fdb85974619d14bfa7d6e3b21f55b032068626e756b3b935fed79039e58dd1b125105602e78e8d
- SSDEEP 1536:vCuP2vyUbCw1jVa629nrBNuuSm3jVDsx:v7P2vy4Cwfa629lxtTVDg
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
61154
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Git\Private\WriteableBitmapEx\Source\WriteableBitmapEx.Wpf\obj\Release\net40\WriteableBitmapEx.Wpf.pdb
mscoree
_CorDllMain
Name
.text
Size
52KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/Xceed.Wpf.AvalonDock.Themes.Aero.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 55200811a8e6d3c099338ab28073eece55333a99224e0fbfe1c945d8af363647
- MD5 f0fbb838887185f1e79b7f7a366e2df3
- SHA1 ecf995526b4e9eaa8e906c6f253aa536345323a3
- SHA512 a5202ec98ef233f5b8ff842277a74679d3b976f1c2478044e02c0d2e81cba7615d5d4466a49ab1c1b86e8e8c017f9b83eb09250d9f4f97a93248dcea2641508b
- SSDEEP 1536:JrgGJ/yox7dMEmjVWm+NdXYoAv/yCJhxaZthvlQiQaNtPTATK5wsx8NTNf8McZO8:JLJ/yox7dMEmjVWm+NdXYoAv/yCJDaZb
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
92226
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Dev\ExtendedWPFToolkit\Release\Latest\OpenSource\Generated\Src\Xceed.Wpf.AvalonDock.Themes.Aero\obj\Release\Xceed.Wpf.AvalonDock.Themes.Aero.pdb
mscoree
_CorDllMain
Name
.text
Size
82KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/Xceed.Wpf.AvalonDock.Themes.Metro.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9d45643f02269ef7caf959b8f48ff50c42b3451e8c7e827f9e6549cb3d1a5391
- MD5 21893117b79c7a2087bf3742e8cc6a56
- SHA1 3c4537721bb84d43cf7874464df6c2cee403b246
- SHA512 bd2069aec858c477764aeb3561bee897bbcbc8d02be8a550616b104a1e596236b7ef4350cab74c56ad19544d03fc945a9380611172e7d5d00d8d9fa8b74397a1
- SSDEEP 1536:lfJs2HNz9vFPPjJo0bs4MN+AQo+V+kM5yCb8:l22HNz9vFPPjy0bMN+AQo+0s
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
84642
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Dev\ExtendedWPFToolkit\Release\Latest\OpenSource\Generated\Src\Xceed.Wpf.AvalonDock.Themes.Metro\obj\Release\Xceed.Wpf.AvalonDock.Themes.Metro.pdb
mscoree
_CorDllMain
Name
.text
Size
75KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/Xceed.Wpf.AvalonDock.Themes.VS2010.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5e63ffd8b2414dca55a01b725b3512e0a9f21352caf69d0b7a0b9952bcaf6d1c
- MD5 b60c1808f3d758fb4b0235b182378d8e
- SHA1 3ecf6ece4e535352a4bda5e17a4c58fb7f9acba0
- SHA512 ed2da9f4786daa2e81c8d9bac53d5d1cfbc22022d7a39faf2aaf5bcabe4eb6497ad9641935d5fd432041486be7a1089060019a96b81553dbb9a5d9a1d81cbc58
- SSDEEP 1536:jefsmzcesTEWSRnqS++gGeqGqPjJo0bsvfjcwKD37niMogEw3o5EZwXkHH+DOhlt:jasmzcesTEWSRnqS++gGeqGqPjy0byfU
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
89774
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Dev\ExtendedWPFToolkit\Release\Latest\OpenSource\Generated\Src\Xceed.Wpf.AvalonDock.Themes.VS2010\obj\Release\Xceed.Wpf.AvalonDock.Themes.VS2010.pdb
mscoree
_CorDllMain
Name
.text
Size
80KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/Xceed.Wpf.AvalonDock.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e399a71b2cb6f707cbfe0d681f1b780764dcdcc29b09c5c8862636d8748b7597
- MD5 db6cd85aca29ddcd8a3963271df8adf6
- SHA1 31fc47278c19322eeeddf4ba1b00e99363112662
- SHA512 fa211d6ed2800baa6a3e323b211e984a278c10c95865e94b875e3e7e3b7747e307443d6324a0c31dc241eb3d6cd7c3d0a7b4a60f91e524f7822d5d7deedf1433
- SSDEEP 12288:KbdhEY77Y7xg7n9720y9c4D4dzbEoW2zXlXxf:K5mY77Y7xg7n975XHzXlXx
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
451766
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Dev\ExtendedWPFToolkit\Release\Latest\OpenSource\Generated\Src\Xceed.Wpf.AvalonDock\obj\Release\Xceed.Wpf.AvalonDock.pdb
mscoree
_CorDllMain
Name
.text
Size
433KB
Virtual Size
433KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/Xceed.Wpf.Toolkit.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e31c0e08a52bf55167f39680d975fe36bbb34039f6bdfa04a429445cd6864458
- MD5 0e72aa1d1749bbce872a900f8fdfb1aa
- SHA1 0a63786d3c054937be206f013b8d38e9f6d5d872
- SHA512 afe200ef6df952c539c8e73e778d53efe6fc0fcc325470204b3f20795db3f31e85c35e261a60e29931439c2cafc4130971e2f21de1cd6206d82a5202151df5f4
- SSDEEP 24576:cu4JP0AjmFGMKllN2z6Ptq6veabGlvNlvUcO9bk88Ix/jUGax/G6y4:eJP0AjmFGMKllN2z61xv0lvNlvU4+NjC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1202942
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Dev\ExtendedWPFToolkit\Release\Latest\OpenSource\Generated\Src\Xceed.Wpf.Toolkit\obj\Release\Xceed.Wpf.Toolkit.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/nUpdate.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 814eb85113211fa90efe952f35d06e537f01bf38febca48e2c0cef02ebdb1877
- MD5 253ba7f0427e3f8e032b97496a019a24
- SHA1 62793783943b04d8836746bb452145722cf63001
- SHA512 29f848f4293454a0103197cd3bb59e364df099b7a26f926673b30132ffe3d15b505fbfc3e0391482d9cd9ed53efd0f3193d0cdf83e0fb59ce3e27de878b83585
- SSDEEP 24576:EmgBM4YvYmukl6XXZlBRVB7bqQJZ8+gkJmUecxkGWrEsXGdHCbXq:Ec4YvRf6ZlBRV0sZ5tmWCb
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2691934
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.6MB
Virtual Size
2.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Administration/libraries/nUpdate.dll.config
- SHA256 4560c371fa83c28464c1489e2cd6c4194d3fff08da6f0a8dd9e7113e9b2b4ede
- MD5 8fd95a14599b6fcb8f31bf86773522b9
- SHA1 c1c35d1b9a05dc23ee7792f971a9b8e40e6129c4
- SHA512 904efe42ae9c0a14ca6753bd471cfca6612220680f5fb4ed02e090a6305ff608d1e9dfb4cae9555f61a4b927cc931f388ed9a99d96b91c9c70f2e5d192bae6d5
- MD5 SHA1 SHA512
Orcus RAT 1.9.1/Orcus.Administration/libraries/sqlite3.dll
- IMPHASH 12baaaec299bc9ff52d20c16e4d0e96a
- SHA256 da1d608be064555ab3d3d35e6db64527b8c44f3fa5ddd7c3ec723f80fc99736e
- MD5 d8aec01ff14e3e7ad43a4b71e30482e4
- SHA1 e3015f56f17d845ec7eef11d41bbbc28cc16d096
- SHA512 f5b2f4bda0cc13e1d1c541fb0caea14081ee4daffd497e31a3d4d55d5f9d85a61158b4891a6527efe623b2f32b697ac912320d9be5c0303812ca98dcc8866fcf
- SSDEEP 12288:kTONzd6F2nsCwZ+yPyCGwRGcdMoWOtg2JW8eM86K4KjttxkdIx:kIRnsCwZ+yPRRGCvWh2/986KsdIx
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4184
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
AreFileApisANSI
CloseHandle
CreateFileA
CreateFileMappingA
CreateFileMappingW
CreateFileW
CreateMutexW
DeleteCriticalSection
DeleteFileA
DeleteFileW
EnterCriticalSection
FlushFileBuffers
FormatMessageA
FormatMessageW
FreeLibrary
GetCurrentProcessId
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetFileAttributesA
GetFileAttributesExW
GetFileAttributesW
GetFileSize
GetFullPathNameA
GetFullPathNameW
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathA
GetTempPathW
GetTickCount
GetVersionExA
GetVersionExW
HeapAlloc
HeapCompact
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
HeapValidate
InitializeCriticalSection
InterlockedCompareExchange
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
LockFile
LockFileEx
MapViewOfFile
MultiByteToWideChar
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
ReadFile
SetEndOfFile
SetFilePointer
Sleep
SystemTimeToFileTime
TlsGetValue
UnlockFile
UnlockFileEx
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile
msvcrt
__dllonexit
_errno
_iob
_winmajor
abort
calloc
fflush
free
fwrite
localtime
malloc
memcmp
memmove
memset
qsort
realloc
strcmp
strncmp
vfprintf
sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_auto_extension
sqlite3_backup_finish
sqlite3_backup_init
sqlite3_backup_pagecount
sqlite3_backup_remaining
sqlite3_backup_step
sqlite3_bind_blob
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_bind_value
sqlite3_bind_zeroblob
sqlite3_blob_bytes
sqlite3_blob_close
sqlite3_blob_open
sqlite3_blob_read
sqlite3_blob_reopen
sqlite3_blob_write
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_cancel_auto_extension
sqlite3_changes
sqlite3_clear_bindings
sqlite3_close
sqlite3_close_v2
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_database_name
sqlite3_column_database_name16
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_double
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_origin_name
sqlite3_column_origin_name16
sqlite3_column_table_name
sqlite3_column_table_name16
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_type
sqlite3_column_value
sqlite3_commit_hook
sqlite3_compileoption_get
sqlite3_compileoption_used
sqlite3_complete
sqlite3_complete16
sqlite3_config
sqlite3_context_db_handle
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_collation_v2
sqlite3_create_function
sqlite3_create_function16
sqlite3_create_function_v2
sqlite3_create_module
sqlite3_create_module_v2
sqlite3_data_count
sqlite3_db_config
sqlite3_db_filename
sqlite3_db_handle
sqlite3_db_mutex
sqlite3_db_readonly
sqlite3_db_release_memory
sqlite3_db_status
sqlite3_declare_vtab
sqlite3_enable_load_extension
sqlite3_enable_shared_cache
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_errstr
sqlite3_exec
sqlite3_expired
sqlite3_extended_errcode
sqlite3_extended_result_codes
sqlite3_file_control
sqlite3_finalize
sqlite3_free
sqlite3_free_table
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_initialize
sqlite3_interrupt
sqlite3_last_insert_rowid
sqlite3_libversion
sqlite3_libversion_number
sqlite3_limit
sqlite3_load_extension
sqlite3_log
sqlite3_malloc
sqlite3_memory_alarm
sqlite3_memory_highwater
sqlite3_memory_used
sqlite3_mprintf
sqlite3_mutex_alloc
sqlite3_mutex_enter
sqlite3_mutex_free
sqlite3_mutex_leave
sqlite3_mutex_try
sqlite3_next_stmt
sqlite3_open
sqlite3_open16
sqlite3_open_v2
sqlite3_os_end
sqlite3_os_init
sqlite3_overload_function
sqlite3_prepare
sqlite3_prepare16
sqlite3_prepare16_v2
sqlite3_prepare_v2
sqlite3_profile
sqlite3_progress_handler
sqlite3_randomness
sqlite3_realloc
sqlite3_release_memory
sqlite3_reset
sqlite3_reset_auto_extension
sqlite3_result_blob
sqlite3_result_double
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_error_code
sqlite3_result_error_nomem
sqlite3_result_error_toobig
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_null
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_value
sqlite3_result_zeroblob
sqlite3_rollback_hook
sqlite3_rtree_geometry_callback
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_shutdown
sqlite3_sleep
sqlite3_snprintf
sqlite3_soft_heap_limit
sqlite3_soft_heap_limit64
sqlite3_sourceid
sqlite3_sql
sqlite3_status
sqlite3_step
sqlite3_stmt_busy
sqlite3_stmt_readonly
sqlite3_stmt_status
sqlite3_strglob
sqlite3_stricmp
sqlite3_strnicmp
sqlite3_table_column_metadata
sqlite3_test_control
sqlite3_thread_cleanup
sqlite3_threadsafe
sqlite3_total_changes
sqlite3_trace
sqlite3_transfer_bindings
sqlite3_update_hook
sqlite3_uri_boolean
sqlite3_uri_int64
sqlite3_uri_parameter
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_numeric_type
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_type
sqlite3_vfs_find
sqlite3_vfs_register
sqlite3_vfs_unregister
sqlite3_vmprintf
sqlite3_vsnprintf
sqlite3_vtab_config
sqlite3_vtab_on_conflict
sqlite3_wal_autocheckpoint
sqlite3_wal_checkpoint
sqlite3_wal_checkpoint_v2
sqlite3_wal_hook
sqlite3_win32_mbcs_to_utf8
sqlite3_win32_set_directory
sqlite3_win32_sleep
sqlite3_win32_utf8_to_mbcs
sqlite3_win32_write_debug
Name
.text
Size
433KB
Virtual Size
432KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/4
Size
512B
Virtual Size
352B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
1024B
Virtual Size
968B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/35
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/51
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/63
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/77
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/89
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/102
Size
512B
Virtual Size
269B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/113
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/124
Size
512B
Virtual Size
432B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Orcus RAT 1.9.1/Orcus.Administration/libraries/starksoft.aspen.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0c52d8a203ba92de6f937a7d458c24854951761ccbbc8d3961bc2b7923239c7c
- MD5 c2a974c1e5972d8772207ef8f9c5e39c
- SHA1 11e2bcc91e20b982e7967c164053f57a2840fcb6
- SHA512 b3250abaf92a2cd81b4eb0e2a0672532165547de90f389c52df61d4f518b8f58569b3d2e0c891dd6f04a6d96f078ba89ddf397d4f486982741bcfcdf4b19fb80
- SSDEEP 768:QoCtkkseuWbDeK2dOBu9ISzsTPzHVZ6EMhI:HfkxfMoo98jzzShI
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
42102
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Dokumente\GitHub\starksoft-aspen\Starksoft.Aspen\obj\Release\starksoft.aspen.pdb
mscoree
_CorDllMain
Name
.text
Size
36KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Server.CommandLine/NLog.config
- SHA256 d56fbacf922973e0c0a1ffb4555c7a6fac9e0e121101bc564fdc4d22e4fef4fa
- MD5 eb612b6a71aead3c35e09b65b5102b1e
- SHA1 d1d6b3ac4a381feb026d80ceeb26d346af0e5e8f
- SHA512 0a95be9da59a3236f541c08f0c3434e0acf2b51a06be3b73f1f341e8c2b22fa1810c323bfb11233836737c07427792089b405c306298a0a9c986d0e120e4b6d3
- MD5 SHA1 SHA512
Orcus RAT 1.9.1/Orcus.Server.CommandLine/Orcus.Server.CommandLine.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 06646f3c76139bb8f84e069a95cac5a5b1a1ffe28e1231f62cdc726660b85110
- MD5 2156c127fc3cbb1aed87de2d26b9e57d
- SHA1 9f93e5bc9c2ae83406f7f0fef8bf60af9a78cbf4
- SHA512 3dd5be1eb9f613be930847c752c72fd86158fcd2675f59910a0a5f717254854f2697eb632bba059073f4a32b699170d20182a25af944225345b9eaca32440193
- SSDEEP 49152:9+4yPRRGCvw2/986PIOolQMdoANAG5ayX82EZ:9+4mRF42/986PimaoACyX82
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1777198
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\a\Orcus-1.9.1-src\Orcus-1.9.1-src\Orcus.Server.CommandLine\obj\Release\Orcus.Server.CommandLine.pdb
mscoree
_CorExeMain
Name
.text
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Server.CommandLine/Orcus.Server.CommandLine.exe.config
- SHA256 c7e2c1cf5f11deaea818badcec637913ff438b6cea3d9209c86fc42bb49620d1
- MD5 028858153f24c95c36cd53c07cac46da
- SHA1 64b279cee7d4bf262fc48b570053a5b4707a32ad
- SHA512 6aaddf6aadfd8aae4c0eb967081bed6a5314b04418d0d68860f2ad21eaed2d1a1de7fd08293477e90eda949f985559567d3241253e014ae05bd1e3705b612011
- MD5 SHA1 SHA512
Orcus RAT 1.9.1/Orcus.Server.CommandLine/sqlite3.dll
- IMPHASH 12baaaec299bc9ff52d20c16e4d0e96a
- SHA256 da1d608be064555ab3d3d35e6db64527b8c44f3fa5ddd7c3ec723f80fc99736e
- MD5 d8aec01ff14e3e7ad43a4b71e30482e4
- SHA1 e3015f56f17d845ec7eef11d41bbbc28cc16d096
- SHA512 f5b2f4bda0cc13e1d1c541fb0caea14081ee4daffd497e31a3d4d55d5f9d85a61158b4891a6527efe623b2f32b697ac912320d9be5c0303812ca98dcc8866fcf
- SSDEEP 12288:kTONzd6F2nsCwZ+yPyCGwRGcdMoWOtg2JW8eM86K4KjttxkdIx:kIRnsCwZ+yPRRGCvWh2/986KsdIx
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4184
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
AreFileApisANSI
CloseHandle
CreateFileA
CreateFileMappingA
CreateFileMappingW
CreateFileW
CreateMutexW
DeleteCriticalSection
DeleteFileA
DeleteFileW
EnterCriticalSection
FlushFileBuffers
FormatMessageA
FormatMessageW
FreeLibrary
GetCurrentProcessId
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetFileAttributesA
GetFileAttributesExW
GetFileAttributesW
GetFileSize
GetFullPathNameA
GetFullPathNameW
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathA
GetTempPathW
GetTickCount
GetVersionExA
GetVersionExW
HeapAlloc
HeapCompact
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
HeapValidate
InitializeCriticalSection
InterlockedCompareExchange
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
LockFile
LockFileEx
MapViewOfFile
MultiByteToWideChar
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
ReadFile
SetEndOfFile
SetFilePointer
Sleep
SystemTimeToFileTime
TlsGetValue
UnlockFile
UnlockFileEx
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile
msvcrt
__dllonexit
_errno
_iob
_winmajor
abort
calloc
fflush
free
fwrite
localtime
malloc
memcmp
memmove
memset
qsort
realloc
strcmp
strncmp
vfprintf
sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_auto_extension
sqlite3_backup_finish
sqlite3_backup_init
sqlite3_backup_pagecount
sqlite3_backup_remaining
sqlite3_backup_step
sqlite3_bind_blob
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_bind_value
sqlite3_bind_zeroblob
sqlite3_blob_bytes
sqlite3_blob_close
sqlite3_blob_open
sqlite3_blob_read
sqlite3_blob_reopen
sqlite3_blob_write
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_cancel_auto_extension
sqlite3_changes
sqlite3_clear_bindings
sqlite3_close
sqlite3_close_v2
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_database_name
sqlite3_column_database_name16
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_double
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_origin_name
sqlite3_column_origin_name16
sqlite3_column_table_name
sqlite3_column_table_name16
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_type
sqlite3_column_value
sqlite3_commit_hook
sqlite3_compileoption_get
sqlite3_compileoption_used
sqlite3_complete
sqlite3_complete16
sqlite3_config
sqlite3_context_db_handle
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_collation_v2
sqlite3_create_function
sqlite3_create_function16
sqlite3_create_function_v2
sqlite3_create_module
sqlite3_create_module_v2
sqlite3_data_count
sqlite3_db_config
sqlite3_db_filename
sqlite3_db_handle
sqlite3_db_mutex
sqlite3_db_readonly
sqlite3_db_release_memory
sqlite3_db_status
sqlite3_declare_vtab
sqlite3_enable_load_extension
sqlite3_enable_shared_cache
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_errstr
sqlite3_exec
sqlite3_expired
sqlite3_extended_errcode
sqlite3_extended_result_codes
sqlite3_file_control
sqlite3_finalize
sqlite3_free
sqlite3_free_table
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_initialize
sqlite3_interrupt
sqlite3_last_insert_rowid
sqlite3_libversion
sqlite3_libversion_number
sqlite3_limit
sqlite3_load_extension
sqlite3_log
sqlite3_malloc
sqlite3_memory_alarm
sqlite3_memory_highwater
sqlite3_memory_used
sqlite3_mprintf
sqlite3_mutex_alloc
sqlite3_mutex_enter
sqlite3_mutex_free
sqlite3_mutex_leave
sqlite3_mutex_try
sqlite3_next_stmt
sqlite3_open
sqlite3_open16
sqlite3_open_v2
sqlite3_os_end
sqlite3_os_init
sqlite3_overload_function
sqlite3_prepare
sqlite3_prepare16
sqlite3_prepare16_v2
sqlite3_prepare_v2
sqlite3_profile
sqlite3_progress_handler
sqlite3_randomness
sqlite3_realloc
sqlite3_release_memory
sqlite3_reset
sqlite3_reset_auto_extension
sqlite3_result_blob
sqlite3_result_double
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_error_code
sqlite3_result_error_nomem
sqlite3_result_error_toobig
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_null
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_value
sqlite3_result_zeroblob
sqlite3_rollback_hook
sqlite3_rtree_geometry_callback
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_shutdown
sqlite3_sleep
sqlite3_snprintf
sqlite3_soft_heap_limit
sqlite3_soft_heap_limit64
sqlite3_sourceid
sqlite3_sql
sqlite3_status
sqlite3_step
sqlite3_stmt_busy
sqlite3_stmt_readonly
sqlite3_stmt_status
sqlite3_strglob
sqlite3_stricmp
sqlite3_strnicmp
sqlite3_table_column_metadata
sqlite3_test_control
sqlite3_thread_cleanup
sqlite3_threadsafe
sqlite3_total_changes
sqlite3_trace
sqlite3_transfer_bindings
sqlite3_update_hook
sqlite3_uri_boolean
sqlite3_uri_int64
sqlite3_uri_parameter
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_numeric_type
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_type
sqlite3_vfs_find
sqlite3_vfs_register
sqlite3_vfs_unregister
sqlite3_vmprintf
sqlite3_vsnprintf
sqlite3_vtab_config
sqlite3_vtab_on_conflict
sqlite3_wal_autocheckpoint
sqlite3_wal_checkpoint
sqlite3_wal_checkpoint_v2
sqlite3_wal_hook
sqlite3_win32_mbcs_to_utf8
sqlite3_win32_set_directory
sqlite3_win32_sleep
sqlite3_win32_utf8_to_mbcs
sqlite3_win32_write_debug
Name
.text
Size
433KB
Virtual Size
432KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/4
Size
512B
Virtual Size
352B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
1024B
Virtual Size
968B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/35
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/51
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/63
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/77
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/89
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/102
Size
512B
Virtual Size
269B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/113
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/124
Size
512B
Virtual Size
432B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Orcus RAT 1.9.1/Orcus.Server/Orcus.Server.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f2b78cee911a9916071d6f634ee4e094e78233306cb2c1d56b4693a1733057a8
- MD5 0ea5a99581630d4f8306ba782f3228b7
- SHA1 cf62e923c75bc87862b1d5265c8ffe5113616315
- SHA512 9d9c26d7b20264ee01378d8946998b105fa1c6e6c0005503d2b70578840ec8b1f3085a9fdbc16c478d4f6b76a63469092b08123ae06037b2af3c457bb073fb0f
- SSDEEP 49152:pB+4yPRRGCvw2/986nZGeE9gw7lQMduOANAG5ayX822sur8BF0xXIHnqww5VCkk5:pB+4mRF42/986wgWmauOACyX822+OxX0
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3013726
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\a\Orcus-1.9.1-src\Orcus-1.9.1-src\Orcus.Server\obj\Release\Orcus.Server.pdb
mscoree
_CorExeMain
Name
.text
Size
2.9MB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus RAT 1.9.1/Orcus.Server/Orcus.Server.exe.config
- SHA256 c7e2c1cf5f11deaea818badcec637913ff438b6cea3d9209c86fc42bb49620d1
- MD5 028858153f24c95c36cd53c07cac46da
- SHA1 64b279cee7d4bf262fc48b570053a5b4707a32ad
- SHA512 6aaddf6aadfd8aae4c0eb967081bed6a5314b04418d0d68860f2ad21eaed2d1a1de7fd08293477e90eda949f985559567d3241253e014ae05bd1e3705b612011
- MD5 SHA1 SHA512