orelia_external.rar
- SHA256 2b5b521a0460cd90758b208a597417c6e7ccd9743d26a2ddcdb1c2d13d051400
Password
orelia
General
- Target orelia_external.rar
- Size 13.4MB
- Sample260922-vm2khsw1bt
- SHA256 2b5b521a0460cd90758b208a597417c6e7ccd9743d26a2ddcdb1c2d13d051400
- MD5 882646a21b56a0f3a27ec0540add4279
- SHA1 f8475c60bb18f2a3087daa5d5eb5ef2c164b83e1
- SHA512 7499bae921d3ba95febd98c91e960ca29c3e4be6553fe7451bde5c55df6ef5a7d28f8a84b141c7aba2ab5e5b6c56d10703a400f29536be845be9f3ff427d226f
- SSDEEP 393216:DozEQxKc1QAkl/+RUqyswN+75+vvTAEGS:AvjQFlnjN+70QS
- TLSH T190E63363C70FDC17780D81ED0A7546412307EFE6F5D2639AAB71B8279280B919CADAF4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/orelia_external/orelia.exe pyinstaller - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/orelia_external/orelia.exe
File Explorer
-
orelia_external.rar.rar 13.4MB
-
orelia_external/orelia.exe.exe 13.6MB
-
Ayhu.pyc33KB
orelia_external/orelia.exe
- IMPHASH cf72283be50852e418ce6bbb6b645835
- SHA256 d6073f7d1508389eb984fcc84236bd45946a81a57225f21d393c4cddc8573497
- MD5 d645a02b020634bec1da91879b168615
- SHA1 4d9a1241504d0e881dcd7ad3b9170df28a7aa836
- SHA512 1867de474d7621dba47227303a7bb39d42286928880b14b8f7b337138a4e0c930003dfe2675ebe6fdc692c7e137495487a438b7957723a44db6333317e54628e
- SSDEEP 393216:ZqoX2drXEAphVta510Mjde6dKa4/vUr5u5D:Zqo6Rphc10MZeVa8vUr5ul
- TLSH T188E63358BBA001FBE9BA003D59A6D852B2F332171B91D2DB17B012663F776F06D3D990
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Password
orelia
Minor OS version
0
Major OS version
6
Entry point
58192
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
ShutdownBlockReasonCreate
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMonitorInfoW
MonitorFromPoint
GetCursorPos
GetSystemMetrics
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
LCMapStringW
CompareStringW
VirtualProtect
GetCurrentDirectoryW
HeapAlloc
GetFileSizeEx
GetConsoleOutputCP
GetOEMCP
GetCPInfo
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleW
MulDiv
FormatMessageW
GetModuleFileNameW
GetEnvironmentStringsW
CreateSymbolicLinkW
SetErrorMode
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
SetFilePointerEx
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
SetDllDirectoryW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapFree
GetConsoleMode
ReadConsoleW
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
178KB
Virtual Size
178KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=183, id=261, version=33145,
count=12, id=260, version=33145,
count=11, id=259, version=33145,
count=3, id=253, version=35721,
count=9, id=259, version=35721,
count=17, id=260, version=35721,
count=39, id=261, version=35721,
count=11, id=257, version=33145,
count=158, id=1, productName=Unmarked objects,
count=29, id=260, version=36246,
count=1, id=258, version=36246,
Ayhu.pyc
- SHA256 ce955bd78e074ddbb31b7e8dbb1c93374a404e9472dc01d77e47d2489ac81ce1
- MD5 60bc01ebc153b6b56022ab76f3b69732
- SHA1 2895976c53d392ff6fcee8e78b0a2c6897945ddb
- SHA512 7ea199efd9dd806b154f1bf2655291a9d7f0d9bb152b1b3ef869f731a6c0badbd6c031ac372f73a89799909d7886bd4bab693f53b8247c989a47da6fdc1dc90a
- SSDEEP 768:A0NVpxmuajFBpypnFts8X2AfyQaXna3tD4I6AxjvqPCBjAN:B3qjfsnFtRPha3adkI6A9qPSjAN
- TLSH T1D0F2F7F9A8606927FEE8F078B0E76196B732C1C5A141C703B02C4C79BFC5275E94765A
- MD5 SHA1 SHA512 SSDEEP TLSH