��0\�����L�$?O�:.�ߣO��rj9ge͗Y�e+1�o�����xǧ���,) �f��~(��1�-@�Bw�7��ʏG�)�TJ��(#��3�9b3As]���F��ꑋ=úf�)�1����"�h�h"ǐ��V�q ��.��<�* K�G����v|m�;G�k6��+��:P�ޤ�DōgK��a�Ai/k$C��T�_U��J$V�����+e��+�N�9�j7(!�a���u ��� �������AI�]#��g�S_��Eue �Q�a���2�)��/I���j�T��@2�T�hY��v�̨��z��X&}Yٟ;�{U���۰���m��"��L����F�ح�A\�u�eJ��bg6��R��W������ ��wרI���!j+��w1ߔdb��\�J�������g-@�u��n�?b�;�A��`ۥ�Y�I�K]�Nc�������b�~&�<fڭ?�I϶��/n�y�U�Vy���@��3� ��B3@U����0��ʍ���No1��<�z{���$e A��*��{E�s��a���t���֩>���i퇑Dhr�<��N=�O��D���t���ݲ`�B�T�� �Z �%��\(��Ws�j9����T�ȅ�(cUȺ� ��a>B�6~jj3Y��UHZ��c�N�_ӤЭ�}2��r$���%����Se�e����6V�-�ILwx�t#���b.u �����+�Μh�܃C����qL*Bi�������ˁ�)�ЃFT��K�whz���k�x&�Ӭj��>��sl����Tz2S�?P��Й��������M��N珻�)4���Ԕ~i�0�^G�Q�\����~id�=�����bGz��Ŷҵ��7qIs8<�?�v˴*&&i�q_�.��*Y|Ǥ~\Jnœ�d�G� ��E�����:ͮ��|����.`�Z�Uu�O�MV� r2���b��!��g�Y�"�=��ѧ�ֈ�dgOs<w�?�[9��K�Js^i��ډC�|ܭN(�����F���7�ɚ�T.š˵ڻ�oc'B,�7D��z��e|�v��E�*U�p�~��Wi�nzK<@jD�Х�Į�$q�b����[�Zs��΅��_�0Gc���%��.�H���R#�lM��&$)� ���T@ p(��|3T�z�([x&������ ڛZ�H���e9<!�q�Mę^�a�����y��߸F���� �,��� �� �Q��V�J�6k��^T�4��-6���"����G�Yɹ ��hh�1H�-���g�.�@�^0e����ë9ʂ�6A�b���;2�����.�<��ݤ}`W����=;�1O �a��f��$z��\����}����?*��@*A2_3�w��(�q^��oq ;b��;_�[��f?ɹ0o-��� �u铁�E��co�H��m��$�6��D�C�=ʿ��p?QT��ՃTR��oS�.�P�H�>(Z0ўjò"�X�1��(�As<��z�bqI��r�:/ pu���꩒d.�9��QP�i_����?(�NDz�2r�����>�-�x?_��Ѥ�%��9�ξ��E{8�ԖK�Aܸ��b���r�M"ZA�Bs`�E�*��~��M5�@ ث�N�����\�݃Ux��c�3����>� � �Y���`^���dC�(8��[PIw_w������y.PL�╃z��痋h� ��F^f=�v��\e��W=�q%� [�C��a���qw�{�o=ɷ?���]���9+��.,�P1>pQ�h� u�L�VN��pB�v�(u�u �Q���C����s�E��ɫ��i�5]�����=�����BAj���7�<��g鿴�x��xct����9�3����|{&ʉG�CU������.�O���=��V6Hg-v �������BG�գ�����8{�Q��Q��7{��w�C���;�vo��T���������~�wt��{�[?���و�:3�t�o��!�"�nup衝н8F!H�����4M���,��C��vM�����yJB�K���uQX�eN~�o �[_1�s����F�n; ���V�2�����~�'�"J��K����+�5���'���wz7���?�������M��ϑ.+��٢[B��#�֤6A�q�aM��'�C��(��^�D�R�ˮ}rZTr�����R���>8q�]��<`��f�!u~ ������hn�;��* Gp ���,����7�� E`�+��xGfd�������7F��=O/Y��Q(�*�U��=3�SU$�pT����ڌ��:���{Z���=��5�o�"�����J|���T���1V>c�@���6�~�r�7z�ݻ8��R�C��S�� �}���;BVTH����,х�/���v���c��a��R=^��;�o�<G�����7�]�f���Wi9��z�\�T��5��g�NQ��8%�2�r8�KQ��]���3��[u ��R�7 �R��.�FmAϏ*#�vb�O�&X�x�ĊSv��}c1eF�~��,]���-��{�?������Yf[�r�7�/��Qd�R}r�FH)���emK��#�%�R��Q���ʧ��Ve�]��*�j����$1#�qn�J��=�Cl��̙���=�FDSCJ]^�@���ݨ/�X�7��錋)��Z���fL.�;ƹ����Ovĥ��yb�,��v��(e�� ��@���R, *�����&������������\����T��z�=�n�n8�W{,���֏�<hQ]r��9�r�O}>m�ڟQ���j9���ȓ�+���[`+�DZ;�nd���(���g>Qi�ށ����>����d������X#���,[�J�~���ldiI���!��Ed��C�n���0�����;YS�U��J����o1�WI�{�r�^Zɽi�f�i�~��i��Vm���ޠ���4/������p����gO���z��e�zE�2q�^����r,�!o�=�y�-��f�ZzH�H���Ϗ�l��Q�k�3�>r���en�+�OTc����o�ˉH��
Static task
static1
Behavioral task
behavioral1
Sample
Orbit.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Orbit.exe
Resource
win10v2004-20240802-en
General
-
Target
Orbit.exe
-
Size
6.1MB
-
MD5
f4b3158c1d1f2dd284dc2e2a8273724b
-
SHA1
6d0676bec0ac12c7979d298e89d52846810d335a
-
SHA256
ca7fc2a95d45fd598f4508c2c6d91e673d22e7cfa34b3bd16133fe5f6129b858
-
SHA512
5c2953cf848fce08f7cbbd6ceb455bf46667ad53e41fea7b874128bf8b878dfedfc9dffaa6973b302c5f0e7336e29d435e9dd521c7d532fd0cb80c41acc74dbc
-
SSDEEP
196608:HOogzqJNdYV8xMf7d1TbKtg/l2RdlDp6zsoMuqzacU/m+6:upqJNo8xMzXSKlKdlD4zsoMuQO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Orbit.exe
Files
-
Orbit.exe.exe windows:6 windows x64 arch:x64
Password: 1234
fc9496ef3b379c4c3d0f044226d28f25
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
gdiplus
GdipBitmapGetPixel
winmm
PlaySoundW
kernel32
CreateFileW
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EnumWindows
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreateCompatibleDC
advapi32
CryptDestroyHash
shell32
SHGetKnownFolderPath
ole32
CoInitializeEx
msvcp140
?_Xinvalid_argument@std@@YAXPEBD@Z
msvcp140_atomic_wait
__std_atomic_wait_direct
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
ws2_32
send
crypt32
CertFreeCertificateContext
imm32
ImmSetCompositionWindow
bcrypt
BCryptGenRandom
vcruntime140_1
__CxxFrameHandler4
vcruntime140
longjmp
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
_errno
api-ms-win-crt-stdio-l1-1-0
_pclose
api-ms-win-crt-convert-l1-1-0
strtof
api-ms-win-crt-string-l1-1-0
wcspbrk
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
setlocale
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-environment-l1-1-0
getenv
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 424KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.orb0 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.orb1 Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 120KB - Virtual size: 119KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ