orcale[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
orcale.zip
Size 2.6MB
Sample260824-fdl15sysay
SHA256 48fa16fd0f29f4396d50eccc0070807e111676c7894aff8250cc8df004bd0185
MD5 81c59a4a8800eb296d91896d807bde52
SHA1 f0e78c460b53c99942616c6bbc5117c1a259ef4f
SHA512 bb871836bbf7000cb7db8f7715d837250a3781ea1394bd9b4716c9b995fe521b01f835121b41518ed02638486f6ffbb2c28bad03c6720e98f1b18f0afc794177
SSDEEP 49152:rnjabbJctleXwxon8V+V/RPgmW+cgl0a36Px7YgxKUKc8LlaVqcPh6:rn2bb+vSwxon8kVhgm0gma36xcbc8LQI
TLSH
T14BC5337912A42449D12C14638CDC74745B276E78D92EAC4E1EE3DE637CAEFBBC711222
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/orcale.exe

File Explorer

orcale.zip

.zip 2.6MB
orcale.exe

.exe 6.3MB

orcale.zip

SHA256 48fa16fd0f29f4396d50eccc0070807e111676c7894aff8250cc8df004bd0185
MD5 81c59a4a8800eb296d91896d807bde52
SHA1 f0e78c460b53c99942616c6bbc5117c1a259ef4f
SHA512 bb871836bbf7000cb7db8f7715d837250a3781ea1394bd9b4716c9b995fe521b01f835121b41518ed02638486f6ffbb2c28bad03c6720e98f1b18f0afc794177
SSDEEP 49152:rnjabbJctleXwxon8V+V/RPgmW+cgl0a36Px7YgxKUKc8LlaVqcPh6:rn2bb+vSwxon8kVhgm0gma36xcbc8LQI
TLSH
T14BC5337912A42449D12C14638CDC74745B276E78D92EAC4E1EE3DE637CAEFBBC711222
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

orcale.exe

IMPHASH 4e2bd2c481372f7ab13b83b63b424e97
SHA256 8f9750c85ce219b6d80b7dc918a3be0152114becb07b4b5adcbcbd5179d8e554
MD5 ca424e555a0623df68f347de062e3312
SHA1 df84c3b9b580c5edd07ab2fd0b2a36e1ff21e08c
SHA512 a77aec0aa6d233e967af01cca901e24f30d1f2e575840f1cce4afe7e1e092bd0275e746943e4287a30653da3e78fa7485e5ac6d76a1cce7a72ca4fc25dbbe9e1
SSDEEP 49152:Nmg9sFnQEgqJON/JqOq5K1vQBuSpiTAO2NaeRzLNZq8Pk+2mAXdRRbjnord5cfKn:NmqSZ5kJwLnqI2NLmc0OZE
TLSH
T176666B17EC6516E9C0ADD13189B6D222BB717C485B2523D32B90F2243F77BE4AEB9350
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

548544

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

407KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

60KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

orcale.zip

orcale.exe

kernel32

generic