c:\Source\Orbiter\Modules\Satsat.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b866f81cfb9e8f28c01cf401d934aedc.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b866f81cfb9e8f28c01cf401d934aedc.dll
Resource
win10v2004-20240226-en
General
-
Target
b866f81cfb9e8f28c01cf401d934aedc
-
Size
756KB
-
MD5
b866f81cfb9e8f28c01cf401d934aedc
-
SHA1
dd6b554cb3b2709ba133ae455d467bfb8de654ae
-
SHA256
44324d770757562ea002ee43e2bc874df02d62c0b5bfd6277ae0b58b5f23d00e
-
SHA512
641e43521252732506ea73f6ddcae3326acf540111cf15396af1fc0379ed938a85efd4b3ff15247a00b30f3eec2f67df762e5d2ab3667fa6a29dbf867d189aae
-
SSDEEP
12288:hi0HoDulGttHeY+HI9pOAEOMa+OFoOoUbNSByPKT1pglY:Q0IDul/71AEXaPFovUbwyUa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b866f81cfb9e8f28c01cf401d934aedc
Files
-
b866f81cfb9e8f28c01cf401d934aedc.dll windows:4 windows x86 arch:x86
914b4ba4615ca14a2241d04602dc2cb6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
orbiter.exe
?Date2Int@@YAHPAD@Z
?InitLib@@YAXPAUHINSTANCE__@@@Z
?oapiTime2MJD@@YANN@Z
??0CELBODY2@@QAE@PAX@Z
??4CELBODY2@@QAEAAV0@ABV0@@Z
?LegacyAtmosphereInterface@CELBODY2@@UBE_NXZ
?clbkAtmParam@CELBODY@@UAE_NNPAUATMPARAM@@@Z
?clbkInit@CELBODY2@@UAEXPAX@Z
??0CELBODY2@@QAE@ABV0@@Z
??1CELBODY2@@UAE@XZ
kernel32
GetCurrentThread
CompareStringW
CompareStringA
SetEndOfFile
GetTimeZoneInformation
GetLocaleInfoW
CreateFileW
CreateFileA
GetConsoleOutputCP
GetProcAddress
WriteConsoleA
SetStdHandle
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
Sleep
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
InterlockedCompareExchange
RtlUnwind
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameW
HeapValidate
IsBadReadPtr
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetLastError
GetModuleHandleA
ExitProcess
LCMapStringA
LCMapStringW
GetCPInfo
DebugBreak
lstrlenA
LoadLibraryA
FatalAppExitA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
SetEnvironmentVariableA
WriteFile
GetConsoleCP
GetConsoleMode
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
ReadFile
SetFilePointer
FlushFileBuffers
CloseHandle
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
SetConsoleCtrlHandler
LoadLibraryW
GetModuleFileNameA
HeapReAlloc
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
GetACP
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeLibrary
GetTimeFormatA
GetDateFormatA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
VirtualQuery
Exports
Exports
??0SATOBJ@@QAE@ABV0@@Z
??0SATOBJ@@QAE@PAXHN@Z
??1SATOBJ@@UAE@XZ
??4SATOBJ@@QAEAAV0@ABV0@@Z
??_7SATOBJ@@6B@
?SaturnEphemeris@@YAXNPAN@Z
?SaturnFastEphemeris@@YAXNPAN@Z
?bEphemeris@SATOBJ@@UBE_NXZ
?clbkEphemeris@SATOBJ@@UAEHNHPAN@Z
?clbkFastEphemeris@SATOBJ@@UAEHNHPAN@Z
GetModuleVersion
InitModule
ModuleDate
Sections
.textbss Size: - Virtual size: 275KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 584KB - Virtual size: 582KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 120KB - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 28KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ