Orbit V4[.]exe | Triage

Sharing

General

Target

Orbit V4.exe
Size

41.7MB
MD5

27ca7a7f3ac4c9c82fa61c2de29a5eab
SHA1

a6f30647b1209626357a5d8771e465f4ce45ce77
SHA256

6671064f59645df0f2e6ab901020388160d60b809c045f1f4b889471051f35cf
SHA512

a3cce48b907d7d64235a2e40914ab309e8161e2472d65798c58371ea501142ff72bb0da7176ffcc4468c15fb4e0a0dcf255d1d8d021d5a0f3a7234b07544c26e
SSDEEP

786432:SvIe00RZrELaFnb4ifs0zD2RkzlVuvCx50qBdzAgU:SvIeL3EL2U0X2RkzlVuAZG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Orbit V4.exe

Files

Orbit V4.exe
.exe windows:4 windows x86 arch:x86

a9c887a4f18a3fede2cc29ceea138ed3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msvcrt

malloc
memset
strcmp
strcpy
getenv
sprintf
fopen
fwrite
fclose
__argc
__argv
_environ
_XcptFilter
__set_app_type
_controlfp
__getmainargs
exit

shell32

ShellExecuteA

kernel32

SetUnhandledExceptionFilter

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41.6MB - Virtual size: 41.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ