Orbit[.]exe | Triage™

Resubmissions

16/06/2024, 16:01

240616-tgan6stdpl6

16/06/2024, 15:46

240616-s7tz3atarn8

Sharing

Copy URL Twitter E-mail

General

Target
Orbit.exe
Size 2.0MB
Sample240616-tgan6stdpl
SHA256 e3b1599e3ec5862347b24336ca0e228d45a0becb6f6da45f619dd8e03e75854a
MD5 5de2a10bbf43eea7059747b139f9f728
SHA1 ee56319da9bb880fcc369002c2c628c76910d38a
SHA512 c206193015d0c663f737b421f77438ff4a62bc4d7cf5016b86a3632ed0ba0f48df6c0ac4e7929fb9f89d37a302ac744c2a0e289c9e669a75537fdd0d4fa8a902
SSDEEP 49152:oKn5Sz1xoQrp2OJChuMb14Z+cjDvkui9XZlXR0RcEnAUwn:W/Nr8py+cjDvkui9XHXmREUwn
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Orbit.exe

File Explorer

Orbit.exe

.exe 2.0MB

Orbit.exe

IMPHASH 84eda6be9a3c61bc4a5674344a3b174e
SHA256 e3b1599e3ec5862347b24336ca0e228d45a0becb6f6da45f619dd8e03e75854a
MD5 5de2a10bbf43eea7059747b139f9f728
SHA1 ee56319da9bb880fcc369002c2c628c76910d38a
SHA512 c206193015d0c663f737b421f77438ff4a62bc4d7cf5016b86a3632ed0ba0f48df6c0ac4e7929fb9f89d37a302ac744c2a0e289c9e669a75537fdd0d4fa8a902
SSDEEP 49152:oKn5Sz1xoQrp2OJChuMb14Z+cjDvkui9XZlXR0RcEnAUwn:W/Nr8py+cjDvkui9XHXmREUwn
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1067124

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\sohil\OneDrive\Dokumentumok\GitHub\Orbit Free\x64\Release\Orbit.pdb

gdiplus

GdipBitmapGetPixel GdipFree GdipDisposeImage GdipCreateBitmapFromHBITMAP GdiplusStartup GdipGetImageHeight GdipCloneImage GdipAlloc GdipGetImageWidth

kernel32

CreateFileW SetFileInformationByHandle AreFileApisANSI VerifyVersionInfoW SleepEx GetCurrentProcessId WaitForMultipleObjects PeekNamedPipe GetFileInformationByHandleEx LocalFree FormatMessageA GetLocaleInfoEx CloseHandle WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry ReadFile GetFileType OpenProcess UnhandledExceptionFilter GetEnvironmentVariableA SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetFileSizeEx ExitProcess GetCurrentDirectoryW GetFileAttributesExW Process32FirstW LoadLibraryA Process32NextW GetLastError Sleep CreateToolhelp32Snapshot WaitForSingleObject GetModuleFileNameW SetConsoleMode GetStdHandle SetLastError CreateEventW SetEvent GetCurrentProcess IsDebuggerPresent GetCurrentThreadId GetSystemDirectoryW GetSystemTimeAsFileTime DeleteCriticalSection GetCommandLineW GetStartupInfoW QueryPerformanceCounter FreeLibrary VerSetConditionMask QueryPerformanceFrequency GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar GetConsoleWindow GetModuleHandleW CreateProcessW FindNextFileW LoadLibraryW FindFirstFileExW FindFirstFileW FindClose WaitForSingleObjectEx InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetTickCount AcquireSRWLockExclusive ReleaseSRWLockExclusive RtlVirtualUnwind GetProcAddress FormatMessageW CreateDirectoryW InitializeSListHead MoveFileExW

user32

GetKeyNameTextW mouse_event GetForegroundWindow GetAsyncKeyState GetSystemMetrics GetDC MapVirtualKeyW SetForegroundWindow EnumWindows ShowWindow GetWindowThreadProcessId SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos ReleaseCapture IsWindowUnicode SetCursorPos SetCursor SetCapture LoadCursorW TrackMouseEvent ClientToScreen GetCapture ScreenToClient GetMessageExtraInfo GetKeyState UnregisterClassA ReleaseDC DestroyWindow TranslateMessage SetWindowDisplayAffinity PeekMessageW DispatchMessageW RegisterClassExW UnregisterClassW SetWindowPos DefWindowProcW GetWindowLongW SendInput GetClientRect PostQuitMessage FindWindowA UpdateWindow SetWindowLongW

gdi32

SelectObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt DeleteObject

advapi32

CryptImportKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW CryptEncrypt LookupPrivilegeValueW RevertToSelf PrivilegeCheck SetTokenInformation OpenProcessToken SetThreadToken CreateProcessAsUserW DuplicateTokenEx GetTokenInformation RegCloseKey RegCreateKeyExW RegSetValueExW RegOpenKeyExW CryptDestroyKey

shell32

SHGetKnownFolderPath

ole32

CoInitializeEx CoTaskMemFree

msvcp140

?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Syserror_map@std@@YAPEBDH@Z _Mtx_destroy_in_situ _Mtx_lock _Mtx_init_in_situ _Cnd_do_broadcast_at_thread_exit _Cnd_wait _Thrd_id _Query_perf_counter _Thrd_detach _Thrd_join _Mtx_unlock _Cnd_broadcast _Cnd_destroy_in_situ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?id@?$ctype@_W@std@@2V0locale@2@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??7ios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_N@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAK@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Throw_Cpp_error@std@@YAXH@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Query_perf_frequency _Cnd_init_in_situ _Thrd_hardware_concurrency ?good@ios_base@std@@QEBA_NXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ ?_Winerror_map@std@@YAHH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

ws2_32

WSAEventSelect getsockopt send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAResetEvent WSAWaitForMultipleEvents closesocket WSASetLastError WSAGetLastError inet_pton ntohs inet_ntop WSAStartup WSACleanup setsockopt WSAIoctl htons socket __WSAFDIsSet select accept bind gethostname ioctlsocket getpeername sendto recvfrom freeaddrinfo getaddrinfo recv listen htonl getsockname connect

crypt32

CryptDecodeObjectEx CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CertOpenStore PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore

imm32

ImmReleaseContext ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler _CxxThrowException longjmp __current_exception_context memcmp memmove __intrinsic_setjmp memchr strrchr wcschr memset memcpy strchr strstr wcsstr __std_terminate __std_exception_copy __std_exception_destroy __current_exception

api-ms-win-crt-heap-l1-1-0

malloc realloc _set_new_mode _callnewh calloc free

api-ms-win-crt-runtime-l1-1-0

_beginthreadex __sys_errlist __sys_nerr _errno abort _register_thread_local_exe_atexit_callback _c_exit _configure_narrow_argv __p___argv __p___argc _invalid_parameter_noinfo_noreturn _initialize_narrow_environment exit _initialize_onexit_table terminate _exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function system

api-ms-win-crt-stdio-l1-1-0

fwrite _set_fmode _close fflush _fileno _lseeki64 fgetpos setvbuf fclose fgets __p__commode _write _wopen ungetc fsetpos fread feof __stdio_common_vswprintf _read fputs _fseeki64 _get_stream_buffer_pointers fopen __acrt_iob_func __stdio_common_vfprintf __stdio_common_vsscanf _wfopen fputc fgetc fseek ftell __stdio_common_vsprintf

api-ms-win-crt-convert-l1-1-0

atof strtoul atoi strtod strtof wcstombs strtol strtoull strtoll

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file _wstat64 _fstat64 _unlink

api-ms-win-crt-string-l1-1-0

isalpha strncmp _wcsicmp _wcsdup strcspn wcspbrk strspn strcmp wcsncmp strpbrk wcsncpy strncpy strcpy_s _strdup

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale localeconv

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_gmtime64 strftime _time64

api-ms-win-crt-math-l1-1-0

powf __setusermatherr acosf _dclass fmodf atan2f _fdopen tan

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

355KB

Virtual Size

355KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

63KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

120KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Orbit.exe

gdiplus

kernel32

user32

gdi32

advapi32

shell32

ole32

msvcp140

d3d11

d3dcompiler_47

dwmapi

ws2_32

crypt32

imm32

bcrypt

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

generic