Orbit_Loader (3)[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

Orbit_Loader (3).exe
Size

5.5MB
MD5

7850ea6b5955e49885d636124ceffdf3
SHA1

3ce1d1e0153bc125c41c12facc7eb66cb418cea7
SHA256

959fc2e0b561354c21c0d7136a05cc454becc4f3a33d81ad7e6f4a66440da703
SHA512

a8f800516d324f02d9f75e8d20ea178827bab9115e601683259ab351aaf4e2e0851054ca52adef1101903934d3c993be915634b19cfbfe9122c686ebb160acd8
SSDEEP

98304:qU34GV+6SRJMvKO95dDoBWuMGhzLxPhn4+lcRP6+PeXA75vh8AEMjFEpg6/6fhsg:qUoGY6SR8jTdkBEGd1PhncfPeQNvM110

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Orbit_Loader (3).exe

Files

Orbit_Loader (3).exe
.exe windows:6 windows x64 arch:x64

90c3a39e14886fde239c5c848d5a0c98

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetModuleHandleA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

d3d9

Direct3DCreate9

user32

SetCursorPos

advapi32

CryptImportKey

shell32

ShellExecuteA

msvcp140

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z

imm32

ImmGetContext

normaliz

IdnToAscii

wldap32

ord26

crypt32

CertCloseStore

ws2_32

recv

shlwapi

PathFindFileNameW

rpcrt4

UuidToStringA

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler

api-ms-win-crt-runtime-l1-1-0

_crt_atexit

api-ms-win-crt-heap-l1-1-0

_callnewh

api-ms-win-crt-stdio-l1-1-0

_set_fmode

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

_strdup

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-math-l1-1-0

cosf

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-filesystem-l1-1-0

_access

api-ms-win-crt-time-l1-1-0

_localtime64

api-ms-win-crt-locale-l1-1-0

localeconv

Sections

Size: - Virtual size: 731KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.imports
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.6U>
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 5.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vr"
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.A;6
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.)gM
Size: 5.5MB - Virtual size: 5.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 469B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

90c3a39e14886fde239c5c848d5a0c98

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

d3d9

user32

advapi32

shell32

msvcp140

imm32

normaliz

wldap32

crypt32

ws2_32

shlwapi

rpcrt4

psapi

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

Size: - Virtual size: 731KB

Size: - Virtual size: 160KB

Size: - Virtual size: 7KB

Size: - Virtual size: 29KB

Size: - Virtual size: 480B

Size: - Virtual size: 1KB

.imports Size: - Virtual size: 4KB

.tls Size: - Virtual size: 4KB

.6U> Size: - Virtual size: 4KB

.themida Size: - Virtual size: 5.7MB

.vr" Size: - Virtual size: 1.3MB

.A;6 Size: 2KB - Virtual size: 2KB

.)gM Size: 5.5MB - Virtual size: 5.5MB

.rsrc Size: 512B - Virtual size: 469B

.imports
Size: - Virtual size: 4KB

.tls
Size: - Virtual size: 4KB

.6U>
Size: - Virtual size: 4KB

.themida
Size: - Virtual size: 5.7MB

.vr"
Size: - Virtual size: 1.3MB

.A;6
Size: 2KB - Virtual size: 2KB

.)gM
Size: 5.5MB - Virtual size: 5.5MB

.rsrc
Size: 512B - Virtual size: 469B