C:\Users\sohil\OneDrive\Dokumentumok\GitHub\Orbit Free\x64\UC\Orbit Unknowncheats.pdb
Static task
static1
1 signatures
General
-
Target
Orbit Unknowncheats.exe
-
Size
2.3MB
-
MD5
debfed81575b081b3096cf0cc1d6fe5d
-
SHA1
465fed4b590b663f513e1ce59f8b0ca0d288a65a
-
SHA256
ae2d4dbd8d30b986ae605c80c86a49980fe496c7666158ac71efd596971447b1
-
SHA512
b2b5bdd3bf2408a5cc938201665bdb07ec796edc015736e9ba856ebe629e46d6721656a298efa4e336215f7b38e12a63d7a2a40a8c061f39041d508cace89232
-
SSDEEP
49152:xa6dFn9L290dDk5igVo45c6uKYyKIH7KS70tlpQBcrP2/4Dj5v7bQ8:fdJ9Lu9Imoyc6uKYyKIH7KSI3uB2
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Orbit Unknowncheats.exe
Files
-
Orbit Unknowncheats.exe.exe windows:6 windows x64 arch:x64
Password: a
30982e14021cd3ed09254ac01569dfb5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
gdiplus
GdipBitmapGetPixel
GdipFree
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdiplusStartup
GdipGetImageHeight
GdipCloneImage
GdipAlloc
GdipGetImageWidth
winmm
PlaySoundW
kernel32
SleepEx
GetCurrentProcessId
SetFileInformationByHandle
AreFileApisANSI
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetFileType
GetEnvironmentVariableA
GetFileInformationByHandleEx
LocalFree
GetLastError
GetLocaleInfoEx
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
WaitForSingleObjectEx
GetStartupInfoW
RtlLookupFunctionEntry
RtlVirtualUnwind
LoadLibraryW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
VerifyVersionInfoW
IsProcessorFeaturePresent
IsDebuggerPresent
GetCommandLineW
GetFileAttributesExW
CreateFileW
FindNextFileW
GetFileSizeEx
FindFirstFileExW
FindFirstFileW
Sleep
CreateToolhelp32Snapshot
ReleaseMutex
WaitForSingleObject
CreateMutexW
GetModuleFileNameW
SetConsoleMode
GetStdHandle
SetLastError
FindClose
CreateDirectoryW
GetCurrentDirectoryW
InitializeCriticalSectionEx
QueryPerformanceCounter
GetCurrentThreadId
CreateEventW
LeaveCriticalSection
EnterCriticalSection
GetTickCount
FreeLibrary
VerSetConditionMask
QueryPerformanceFrequency
GetModuleHandleA
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
GetConsoleWindow
GetModuleHandleW
CreateProcessW
GetProcAddress
CloseHandle
Process32FirstW
LoadLibraryA
SetEvent
ExitProcess
OpenProcess
GetCurrentProcess
GetSystemDirectoryW
GetModuleFileNameA
LoadLibraryExA
FormatMessageW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
MoveFileExW
Process32NextW
FormatMessageA
DeleteCriticalSection
InitializeSListHead
GetSystemTimeAsFileTime
user32
SetCursorPos
GetKeyNameTextW
mouse_event
GetForegroundWindow
GetAsyncKeyState
GetSystemMetrics
GetDC
MapVirtualKeyW
EnumDisplaySettingsW
SetForegroundWindow
EnumWindows
ShowWindow
GetWindowThreadProcessId
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
GetCursorPos
ReleaseCapture
IsWindowUnicode
GetClientRect
ReleaseDC
SetCapture
LoadCursorW
TrackMouseEvent
ClientToScreen
GetCapture
ScreenToClient
GetMessageExtraInfo
SendInput
GetKeyState
UpdateWindow
UnregisterClassA
FindWindowA
PostQuitMessage
SetWindowLongW
TranslateMessage
SetWindowDisplayAffinity
PeekMessageW
DispatchMessageW
RegisterClassExW
UnregisterClassW
SetWindowPos
DefWindowProcW
GetWindowLongW
DestroyWindow
SetCursor
gdi32
DeleteObject
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
BitBlt
DeleteDC
advapi32
CryptHashData
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
CryptDestroyHash
CryptDestroyKey
CryptImportKey
LookupPrivilegeValueW
RevertToSelf
CryptEncrypt
PrivilegeCheck
SetTokenInformation
OpenProcessToken
SetThreadToken
CreateProcessAsUserW
DuplicateTokenEx
GetTokenInformation
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
CryptCreateHash
shell32
SHGetKnownFolderPath
ole32
CoInitializeEx
CoTaskMemFree
msvcp140
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Syserror_map@std@@YAPEBDH@Z
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_init_in_situ
_Cnd_do_broadcast_at_thread_exit
_Query_perf_counter
_Thrd_detach
_Mtx_unlock
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??Bios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?id@?$ctype@_W@std@@2V0locale@2@A
?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??7ios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?widen@?$ctype@_W@std@@QEBA_WD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Throw_Cpp_error@std@@YAXH@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Query_perf_frequency
_Thrd_hardware_concurrency
?good@ios_base@std@@QEBA_NXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Xbad_alloc@std@@YAXXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exceptions@std@@YAHXZ
?_Winerror_map@std@@YAHH@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
ws2_32
send
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
closesocket
WSASetLastError
WSAGetLastError
inet_pton
ntohs
inet_ntop
WSAStartup
WSACleanup
getsockopt
WSAIoctl
htons
socket
__WSAFDIsSet
select
gethostname
ioctlsocket
getpeername
sendto
recvfrom
freeaddrinfo
getaddrinfo
recv
listen
htonl
getsockname
setsockopt
bind
connect
accept
crypt32
CertOpenStore
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringW
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryW
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
imm32
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
ImmSetCandidateWindow
bcrypt
BCryptGenRandom
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
_CxxThrowException
longjmp
__intrinsic_setjmp
__std_terminate
__C_specific_handler
wcschr
__current_exception
memcmp
memmove
memchr
strrchr
memset
memcpy
strchr
strstr
wcsstr
__std_exception_copy
__std_exception_destroy
api-ms-win-crt-heap-l1-1-0
realloc
free
_set_new_mode
calloc
_callnewh
malloc
api-ms-win-crt-runtime-l1-1-0
__sys_errlist
_errno
terminate
abort
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_invalid_parameter_noinfo_noreturn
exit
_crt_atexit
system
_cexit
strerror
_seh_filter_exe
_set_app_type
_get_initial_narrow_environment
_initterm
_initterm_e
_beginthreadex
_exit
__p___argc
_register_thread_local_exe_atexit_callback
_c_exit
__p___argv
__sys_nerr
api-ms-win-crt-stdio-l1-1-0
tmpfile
_ftelli64
clearerr
_popen
_pclose
fseek
__p__commode
_set_fmode
fclose
__stdio_common_vsprintf
_read
_write
fgetc
_fileno
_close
ferror
freopen
getc
fflush
_wopen
__stdio_common_vfprintf
fputc
tmpnam
__acrt_iob_func
fopen
_get_stream_buffer_pointers
_fseeki64
fread
fsetpos
ungetc
_lseeki64
_wfopen
__stdio_common_vsscanf
setvbuf
fgets
ftell
fputs
fwrite
__stdio_common_vswprintf
feof
fgetpos
api-ms-win-crt-convert-l1-1-0
strtoll
atoi
atof
strtoul
strtod
wcstombs
strtol
strtof
strtoull
api-ms-win-crt-filesystem-l1-1-0
rename
_unlink
_lock_file
_unlock_file
remove
_fstat64
_wstat64
api-ms-win-crt-string-l1-1-0
strcmp
strcspn
isalpha
strcpy_s
_wcsdup
_wcsicmp
strncmp
toupper
wcsncmp
strpbrk
strncpy
wcsncpy
strspn
strcoll
_strdup
isdigit
isblank
isalnum
tolower
iscntrl
isgraph
ispunct
isspace
isxdigit
islower
isupper
wcspbrk
api-ms-win-crt-math-l1-1-0
__setusermatherr
fmodf
tanh
atan2f
acosf
sqrt
sinh
_dclass
sin
pow
_fdopen
log10
log
fmod
exp
cosh
cos
ceil
atan2
asin
powf
acos
ldexp
floor
tan
llround
frexp
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
_configthreadlocale
localeconv
setlocale
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-time-l1-1-0
_gmtime64
strftime
_difftime64
_mktime64
_time64
_localtime64
clock
api-ms-win-crt-environment-l1-1-0
getenv
Sections
.text Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 404KB - Virtual size: 403KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 79KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 120KB - Virtual size: 119KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ