C:\Users\sohil\OneDrive\Dokumentumok\GitHub\Orbit Free\x64\Release\Orbit.pdb
Static task
static1
Behavioral task
behavioral1
Sample
Orbit.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Orbit.exe
Resource
win10v2004-20240419-en
General
-
Target
Orbit.exe
-
Size
1.2MB
-
MD5
75999bc3817de569ef5f0d520fd0a6f0
-
SHA1
6790816faea5b2debbec2f3b59a900794dc43c66
-
SHA256
ec253df88529dcc7f05135517854bdca0f4f654fc70f5727f1ce7c3e5a52beda
-
SHA512
d49d7c52c5dc53e8ad60269aca626e37ff6e104009ef63240767c4ac7937231aaadee75b2e4a8b4ccafdcfabcd391ab52e5f0ace6efc7548d516ae582ef51c6f
-
SSDEEP
12288:bz1AKgDdAtWmpe/o2xpl2QKmjJ+Y0s3s66TtQnW1HFoOWbcfEWmUm1Hn+owjEM8:bz1A4w/JxplsAJazTtMaF/yZUm1Hn+l
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Orbit.exe
Files
-
Orbit.exe.exe windows:6 windows x64 arch:x64
139ce98c1508c70987b5d1e40f4df284
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
gdiplus
GdipBitmapGetPixel
GdipFree
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdiplusStartup
GdipGetImageHeight
GdipCloneImage
GdipAlloc
GdipGetImageWidth
kernel32
GetModuleHandleW
GetConsoleWindow
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceFrequency
FreeLibrary
QueryPerformanceCounter
GetStartupInfoW
GetCommandLineW
GetCurrentProcess
OpenProcess
ExitProcess
RtlLookupFunctionEntry
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
GetProcAddress
GetFileAttributesExW
UnhandledExceptionFilter
Process32NextW
SetFileInformationByHandle
AreFileApisANSI
GetFileInformationByHandleEx
LocalFree
FormatMessageA
GetLocaleInfoEx
ReleaseSRWLockExclusive
CreateProcessW
CloseHandle
Process32FirstW
FindNextFileW
LoadLibraryA
AcquireSRWLockExclusive
GetLastError
CreateToolhelp32Snapshot
WakeAllConditionVariable
SleepConditionVariableSRW
RtlVirtualUnwind
WaitForSingleObject
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetCurrentProcessId
SetConsoleMode
GetStdHandle
SetLastError
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
Sleep
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
user32
GetWindowLongW
ReleaseDC
SetWindowPos
UnregisterClassW
RegisterClassExW
DispatchMessageW
DefWindowProcW
PeekMessageW
SetWindowDisplayAffinity
TranslateMessage
SetWindowLongW
PostQuitMessage
FindWindowA
UpdateWindow
DestroyWindow
UnregisterClassA
GetKeyState
GetMessageExtraInfo
ScreenToClient
GetCapture
ClientToScreen
SetCursorPos
GetKeyNameTextW
SetClipboardData
mouse_event
GetForegroundWindow
EmptyClipboard
CloseClipboard
OpenClipboard
GetAsyncKeyState
GetSystemMetrics
SendInput
GetDC
MapVirtualKeyW
SetForegroundWindow
EnumWindows
ShowWindow
GetWindowThreadProcessId
GetClipboardData
TrackMouseEvent
LoadCursorW
SetCapture
SetCursor
GetClientRect
IsWindowUnicode
ReleaseCapture
GetCursorPos
gdi32
SelectObject
BitBlt
DeleteDC
DeleteObject
CreateCompatibleDC
CreateCompatibleBitmap
advapi32
SetThreadToken
DuplicateTokenEx
GetTokenInformation
GetUserNameA
OpenProcessToken
SetTokenInformation
PrivilegeCheck
RevertToSelf
LookupPrivilegeValueW
CreateProcessAsUserW
shell32
SHGetKnownFolderPath
ole32
CoInitializeEx
CoTaskMemFree
msvcp140
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?_Xbad_function_call@std@@YAXXZ
?_Incref@facet@locale@std@@UEAAXXZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAK@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?good@ios_base@std@@QEBA_NXZ
_Thrd_hardware_concurrency
_Query_perf_frequency
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Winerror_map@std@@YAHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Syserror_map@std@@YAPEBDH@Z
_Query_perf_counter
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??Bios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?_Throw_Cpp_error@std@@YAXH@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??7ios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?id@?$ctype@D@std@@2V0locale@2@A
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
imm32
ImmSetCandidateWindow
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strrchr
_CxxThrowException
__C_specific_handler
__current_exception_context
__current_exception
strstr
memchr
memcmp
memset
__std_terminate
__std_exception_copy
memcpy
memmove
__std_exception_destroy
longjmp
__intrinsic_setjmp
api-ms-win-crt-heap-l1-1-0
_callnewh
free
_set_new_mode
malloc
api-ms-win-crt-string-l1-1-0
strcmp
strcpy_s
strncpy
_wcsicmp
strncmp
wcslen
strlen
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_cexit
_seh_filter_exe
_set_app_type
exit
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
_beginthreadex
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_invalid_parameter_noinfo_noreturn
_errno
system
abort
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
_wfopen
fopen
fflush
fseek
fclose
fread
__acrt_iob_func
ftell
feof
_popen
fsetpos
fgets
ungetc
setvbuf
fgetpos
__p__commode
__stdio_common_vsscanf
fwrite
fgetc
_pclose
_set_fmode
_get_stream_buffer_pointers
fputc
_fseeki64
__stdio_common_vsprintf
api-ms-win-crt-convert-l1-1-0
strtol
strtof
atof
api-ms-win-crt-utility-l1-1-0
qsort
abs
api-ms-win-crt-math-l1-1-0
fmodf
sinf
cosf
sqrtf
floorf
__setusermatherr
ceilf
acosf
atan2f
powf
fabs
tan
pow
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
Sections
.text Size: 828KB - Virtual size: 828KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 229KB - Virtual size: 228KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 120KB - Virtual size: 119KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ