C:\Users\sohil\OneDrive\Dokumentumok\GitHub\Orbit Free\x64\Release\Orbit.pdb
Static task
static1
Behavioral task
behavioral1
Sample
Orbit.exe
Resource
win10v2004-20240412-en
General
-
Target
Orbit.exe
-
Size
1.2MB
-
MD5
6e3240d478348725102c3b247b9617ff
-
SHA1
67af174be0e90cc9ad2de39b848e1733f4ab8519
-
SHA256
acc3307d40f04b288c5d75d32158713b679ebebcbd05ba25931ff2ca39361ec9
-
SHA512
6877326facbd05697f22a73e62e711896b70b5c43bee061e5a648003bb4dc66fcf306483be1f00bb17a406552371dc3b0d3224e24451818673331d4ef4be88bf
-
SSDEEP
24576:MWZ2yclKyqmhNCIwgPTYwk3lZCpZn/1jn+o+I:xQKVmNDPZMqNn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Orbit.exe
Files
-
Orbit.exe.exe windows:6 windows x64 arch:x64
7ff22d18d45921e138a12a68af4d32a3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
gdiplus
GdipBitmapGetPixel
GdipFree
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdiplusStartup
GdipGetImageHeight
GdipCloneImage
GdipAlloc
GdipGetImageWidth
kernel32
GetModuleHandleW
GetConsoleWindow
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceFrequency
FreeLibrary
QueryPerformanceCounter
GetStartupInfoW
GetCommandLineW
GetCurrentProcess
OpenProcess
ExitProcess
RtlLookupFunctionEntry
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
GetProcAddress
GetFileAttributesExW
UnhandledExceptionFilter
Process32NextW
AreFileApisANSI
GetFileInformationByHandleEx
LocalFree
FormatMessageA
GetLocaleInfoEx
ReleaseSRWLockExclusive
CreateProcessW
CloseHandle
Process32FirstW
FindNextFileW
LoadLibraryA
AcquireSRWLockExclusive
GetLastError
CreateToolhelp32Snapshot
WakeAllConditionVariable
SleepConditionVariableSRW
RtlVirtualUnwind
WaitForSingleObject
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetCurrentProcessId
SetConsoleMode
GetStdHandle
SetLastError
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
Sleep
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
user32
GetWindowLongW
ReleaseDC
SetWindowPos
UnregisterClassW
RegisterClassExW
DispatchMessageW
DefWindowProcW
PeekMessageW
SetWindowDisplayAffinity
TranslateMessage
SetWindowLongW
PostQuitMessage
FindWindowA
UpdateWindow
DestroyWindow
UnregisterClassA
GetKeyState
GetMessageExtraInfo
ScreenToClient
GetCapture
ClientToScreen
SetCursorPos
GetKeyNameTextW
SetClipboardData
mouse_event
GetForegroundWindow
EmptyClipboard
CloseClipboard
OpenClipboard
GetAsyncKeyState
GetSystemMetrics
SendInput
GetDC
MapVirtualKeyW
SetForegroundWindow
EnumWindows
ShowWindow
GetWindowThreadProcessId
GetClipboardData
TrackMouseEvent
LoadCursorW
SetCapture
SetCursor
GetClientRect
IsWindowUnicode
ReleaseCapture
GetCursorPos
gdi32
SelectObject
BitBlt
DeleteDC
DeleteObject
CreateCompatibleDC
CreateCompatibleBitmap
advapi32
SetThreadToken
DuplicateTokenEx
GetTokenInformation
GetUserNameA
OpenProcessToken
SetTokenInformation
PrivilegeCheck
RevertToSelf
LookupPrivilegeValueW
CreateProcessAsUserW
shell32
SHGetKnownFolderPath
ole32
CoInitializeEx
CoTaskMemFree
msvcp140
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?_Xbad_function_call@std@@YAXXZ
?_Incref@facet@locale@std@@UEAAXXZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAK@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?good@ios_base@std@@QEBA_NXZ
_Thrd_hardware_concurrency
_Query_perf_frequency
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Winerror_map@std@@YAHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Syserror_map@std@@YAPEBDH@Z
_Query_perf_counter
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?_Throw_Cpp_error@std@@YAXH@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xinvalid_argument@std@@YAXPEBD@Z
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??7ios_base@std@@QEBA_NXZ
??Bios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
imm32
ImmSetCandidateWindow
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strrchr
_CxxThrowException
__C_specific_handler
__current_exception_context
__current_exception
strstr
memchr
memcmp
memset
__std_terminate
__std_exception_copy
memcpy
memmove
__std_exception_destroy
longjmp
__intrinsic_setjmp
api-ms-win-crt-heap-l1-1-0
free
_callnewh
_set_new_mode
malloc
api-ms-win-crt-string-l1-1-0
strcmp
strcpy_s
strncpy
_wcsicmp
strncmp
wcslen
strlen
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
exit
_cexit
_seh_filter_exe
_set_app_type
_invalid_parameter_noinfo_noreturn
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_errno
system
_beginthreadex
terminate
abort
api-ms-win-crt-stdio-l1-1-0
fflush
__p__commode
fopen
fclose
fgetc
_set_fmode
fputc
__stdio_common_vsscanf
__stdio_common_vsprintf
_wfopen
__stdio_common_vfprintf
fread
fseek
fsetpos
__acrt_iob_func
ungetc
setvbuf
fgetpos
ftell
fwrite
feof
_popen
fgets
_pclose
_get_stream_buffer_pointers
_fseeki64
api-ms-win-crt-utility-l1-1-0
qsort
abs
api-ms-win-crt-math-l1-1-0
cosf
fabs
__setusermatherr
floorf
pow
fmodf
ceilf
acosf
atan2f
sqrtf
sinf
powf
tan
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-convert-l1-1-0
strtol
atof
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
Sections
.text Size: 811KB - Virtual size: 811KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 226KB - Virtual size: 226KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 120KB - Virtual size: 119KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ