@�@f ��k��(������]��R���}�F�a�����Gq�[��A6������\ �l���B'��V�Pz���^]( ��^)rL��ݵ<[��i+�~�[r�6�����f��eݔ�o+��O�\{$(L��+��ET���= ;��"\��/M~�TZ�`��)�S�-����x6:�� ������> R^��Xh8})�g���n���2��_����7��������h� ګ����]�eͦ6��/g��� y�R¯�kv���b0�u���uQ/t���@(�@�ʡ�&��4�R���ؿ�U���'7"S_���k�����j5�=�o�s�m������*���'D��x���d1�Ux�c��=����qaF��^:u~ْAS �?�����t��)�=��G ̫���ۯ�G�ie�o�#ԋ6�J(����D�ơ?ѩ2湤U`RM=�����p��xR4���`��%���o�iGc���Ր#�mȅ�o_��ބڋ�ݟR_�h5����B��p���-��rv�B��\�F_�T;��D���E\ǿ A���+ބ�T�>�=�8 + �X��#��������#5"���O�SDm�N�d��m�=u�G,-�s��-����+(�4�WB�� C�� �P�{5!��o�"�V��"�7�dŶE[��Q<=��S�x�T[>�ȡ��B����lF�G�b�F�JhAd"��N):�b���jR��>��뺽B0������/��K �,]�c�s+�#�x���&��w���j�����_�p���1$�l�4�--/ſ����� -%3U��~���.��$��;��B��iq�{�_�r|�/�ޅ7q_[�ɗ�ۃ�D��iK�ocA����>��������,g��sh��v�Y�C���l6����q�:�}?�E�5R5��$@�X�9<&~5�����uH`��fi!���K�k�2[fs?�V�mieC:&����t` r�(�4�)�aR�`'b�3E��y�Vqq#C3~�/���8�ə���쑵�j�Ԓ�T��)cz¿�*��Ǟ����sTB����m�[{/%�22�1�hd����0Z�&X_WXN)M����R3��AM�c̈́<�w^5IY<'���Y��i�?�"���d��0�rs:����5ז�����׃X�r�r�'u�Zp����[Ð3p?jBޥC!���[G cw �����?P@��3��&¹�D��$�P��ns!�-jGK�'�0����;�2��Ɍ�^���0���|�9C�!Q�����y)FTy��c=QY�),h�4&{;��� ���Q�o,"4#��� T�k$�Th��~��5���]�t���5*<\%v���[�� �J�9H]A���pb!jb�U~Z���܈��������rC[L ��گ���8M�Dά���U@��!a�k�vNU�.<B{��@�Xśi�������b�¥=x���z�G��4b^�ˈj�����ߨ�f��D�t�g)�}�F��#�7d1"heẈ����Nʱ6�hc�hbS�ⲉr��ow8.(�@+�z5�UQO�o/ћu���]�w!��ŭ�So��*��v��|�K ��/�J��Jd��A�4ʡ9�{q�Xd���D?1�D���M_�s��W%��7DNk�㴆��qK�?��+LK�C%ż !F�J�ƹ���՜�����:�}�k@wm8�=G_�L�V�����%���DL�lf�a~|�њѢ�W�_ n[��T:Ib N�i�Mu�Wx4��V��h?� ���/b|W�>�EA ��3���ATy��m/"�s�c�E��H+�l/-8íVT��7C]�.�tMv7r����b��k�4oq~T�:M� e��7�A��T��rΩ)&��N �g���41�)���#�(�Crׇ��H�q��_K�o�_f&/��1��:����|j�W��[��ʶ.����Kq��*I��V���?@8�]V��!�xAf���S �)��'��+�@*�r*�T���|JH^�N07�T ����]�([��F^4ٮp�~��W�uYȍ��)|쌃ܑ��22�2��ܦ�TLw#)�sS��#r=�N/V���І��f�J�� l�-EȒV���(��]��4I�wӬ4��'O����/u����A�[�IA�,��#�%^��Ըf;'T�k]"�����Ay�B�ԯH�X��k=pC٫r�c�4l5x5iez� }����Ẉ��-�O�f4V 33!����f>����"Rj��x��k� ����6��,�R'd�@ƱS�6�-Y|��<jKU*������R�.l�[�B<ρ���e���X���O&J<�x ���%�Ȥ��4�^ '�HF �`��B�=+6�Ķjw��#_���M�Y��r�+�ۏe��nkg�=%�ːF�J6Ă��^$5�6�?������Ād2،�߅��6lr�xٝ�������>a��TJ�6��O�J���-� ����_�+��)���O�jA�8P� BT�J��z(�.ƀ�E"��No��"q��a���uq�n��)����;=�#��>���<-b;Bʠ=گ?�&����7X*�L��8R�6T� ؖ�U�\ӝ�rM��juwxӇ91/p^�����%P��E)eY��(��^Ȇ�nl1-�R�:4��x!Ņol࢜Y�6=�u�,��1�,~BaH���i ��'�`��z�H$�d�6UFN��SL�i���:ρ�K�.����ﷸ�=�=�VKM�l��C�� =�>���y�mI'���� nGnB���شqJ1 ��r���9�pRU��\�D� H��U�*34�i���6KA�'���먎ܳ^.��r��=Μ�p�ſ��qK�&xz�ԓ���L}"j�k}���,� ��Ff��:r��wB�^`�����-���YB�k�A�.��@��Sj�lF��7s�vP�QVJB���{U-8@�R!��7�6�*TaG2ޖm7��Q�1dy9u��M��+�/�a���f'���K���Co_�����J] ���ɑS
Static task
static1
Behavioral task
behavioral1
Sample
Orbit.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
Orbit.exe
Resource
win10v2004-20240709-en
General
-
Target
Orbit.exe
-
Size
6.1MB
-
MD5
700300c1cb6a6e3a9dd7850235043d09
-
SHA1
8e9604dbe9c606d5f8ea8e352873eae569bfea84
-
SHA256
52a7b3dda0639c05a74bd5b6dcae55515c31b81fcaeb82ceadef874259d20abe
-
SHA512
8a187fa8088f4ef3f519536f7611e817bb502022ff1ccb34ee3aeecffae7dc671e772b7043bb6ad0e58a698706d1232f5260e79a6d8c8a538d410cd0f007aed5
-
SSDEEP
98304:vPPtKjYyTDzm7gsI5KzsdsvWUzTPVsXeUuPuVErQNQs9yLjtNdAFA:vPPUdDz5sUKzsdOzhsXeXuf9UBY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Orbit.exe
Files
-
Orbit.exe.exe windows:6 windows x64 arch:x64
Password: 123
1e01ddf988c54c33608d597c49a1f58d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
gdiplus
GdipBitmapGetPixel
winmm
PlaySoundW
kernel32
GetFileAttributesExW
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetKeyNameTextW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
DeleteObject
advapi32
CryptCreateHash
shell32
ShellExecuteW
ole32
CoInitializeEx
msvcp140
?_Xbad_function_call@std@@YAXXZ
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
ws2_32
send
crypt32
CryptDecodeObjectEx
imm32
ImmReleaseContext
bcrypt
BCryptGenRandom
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-stdio-l1-1-0
fread
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-string-l1-1-0
isupper
api-ms-win-crt-filesystem-l1-1-0
rename
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-time-l1-1-0
_difftime64
api-ms-win-crt-environment-l1-1-0
getenv
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 418KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.orb0 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.orb1 Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 120KB - Virtual size: 119KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ