C:\Users\kingofnetflix\Desktop\Gorilla-Tag-Mod-Menu-Template-master\obj\Release\ShibaGT Gold.pdb
Overview
overview
10Static
static
3Orbit Paid...ed.dll
windows10-2004-x64
1Orbit Paid...ed.dll
windows11-21h2-x64
4SharpMonoI...or.dll
windows10-2004-x64
1SharpMonoI...or.dll
windows11-21h2-x64
1SharpMonoI...mi.exe
windows10-2004-x64
1SharpMonoI...mi.exe
windows11-21h2-x64
1injection.bat
windows10-2004-x64
10injection.bat
windows11-21h2-x64
10Static task
static1
Behavioral task
behavioral1
Sample
Orbit Paid Semi Deobfuscated.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
Orbit Paid Semi Deobfuscated.dll
Resource
win11-20240419-en
Behavioral task
behavioral3
Sample
SharpMonoInjector.Console/SharpMonoInjector.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral4
Sample
SharpMonoInjector.Console/SharpMonoInjector.dll
Resource
win11-20240419-en
Behavioral task
behavioral5
Sample
SharpMonoInjector.Console/smi.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral6
Sample
SharpMonoInjector.Console/smi.exe
Resource
win11-20240419-en
Behavioral task
behavioral7
Sample
injection.bat
Resource
win10v2004-20240426-en
Behavioral task
behavioral8
Sample
injection.bat
Resource
win11-20240426-en
General
-
Target
Orbit-Paid-Cracked.exe
-
Size
281KB
-
MD5
258109965cd2bb45737840f35451eada
-
SHA1
6f07a929a89fe5fe773a9ad77345f19a79fd6d04
-
SHA256
62102854c1e59b7f974b5ebedc01fa9018c80b2c2dfdb2842ab8aab89904275c
-
SHA512
6f0774b9c0ba86c3fd2376807263e9f3f13b7199f02f1b7539dc3491ffb2c315150b8959c44dafba11340e33dc3c882fcebc495e5346952745113528eabdbcf4
-
SSDEEP
6144:b3ZVT6iP+6W6jZW5Jne5qpPgR5kALgamPSzgXXECYXT7x:NV+MRjZye5hzgqQETXx
Malware Config
Signatures
-
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Orbit Paid Semi Deobfuscated.dll unpack001/SharpMonoInjector.Console/SharpMonoInjector.dll unpack001/SharpMonoInjector.Console/smi.exe
Files
-
Orbit-Paid-Cracked.exe.rar
-
Orbit Paid Semi Deobfuscated.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
mscoree
_CorDllMain
Sections
.text Size: 258KB - Virtual size: 257KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 936B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
SharpMonoInjector.Console/SharpMonoInjector.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
D:\projects\SharpMonoInjector\src\SharpMonoInjector\obj\Release\netstandard2.0\SharpMonoInjector.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 876B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
SharpMonoInjector.Console/smi.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
D:\projects\SharpMonoInjector\src\SharpMonoInjector.Console\obj\Release\smi.pdb
Imports
mscoree
_CorExeMain
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
injection.bat