ORBIT LOADER[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

ORBIT LOADER.exe
Size

5.7MB
MD5

aedde1baad89075a5e910d49cd6d420a
SHA1

98235f2a33658bdeb3d44a0efae31872473c2d2f
SHA256

000bb76f4ded3436cb667bd1a5c6e33cbae9d478ea0bf69a4863945f2e36c938
SHA512

ee381f58292676e9a536d1b837fab2db8b90eb2f7cca4ff42b239c84ec54cfcda8ca67cc53a337fa5751d075a9cf8933ab22a25c9146c1054b2986b906663da5
SSDEEP

98304:8+UvzoyTJKG66OZoJfR8nEPjbpNRhxMda1h8XBuZIDMWR29muAjcLTgyb5kzx:BUvzdC2ZR8ejbpNRDMU4xuGDMWRmVACM

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ORBIT LOADER.exe

Files

ORBIT LOADER.exe
.exe windows:6 windows x64 arch:x64

9a1416a550d3c6d5ba1980b17d1a47c5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetModuleHandleA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress

d3d9

Direct3DCreate9

user32

SetCursorPos

advapi32

CryptImportKey

shell32

ShellExecuteA

msvcp140

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z

imm32

ImmGetContext

normaliz

IdnToAscii

wldap32

ord26

crypt32

CertCloseStore

ws2_32

recv

shlwapi

PathFindFileNameW

rpcrt4

UuidToStringA

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler

api-ms-win-crt-runtime-l1-1-0

_crt_atexit

api-ms-win-crt-heap-l1-1-0

_callnewh

api-ms-win-crt-stdio-l1-1-0

_set_fmode

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

_strdup

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-math-l1-1-0

cosf

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-filesystem-l1-1-0

_access

api-ms-win-crt-time-l1-1-0

_localtime64

api-ms-win-crt-locale-l1-1-0

localeconv

Sections

Size: - Virtual size: 731KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.imports
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.W;*
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 6.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.><l
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.;,?
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.+68
Size: 5.7MB - Virtual size: 5.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 469B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9a1416a550d3c6d5ba1980b17d1a47c5

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

d3d9

user32

advapi32

shell32

msvcp140

imm32

normaliz

wldap32

crypt32

ws2_32

shlwapi

rpcrt4

psapi

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

Size: - Virtual size: 731KB

Size: - Virtual size: 160KB

Size: - Virtual size: 7KB

Size: - Virtual size: 29KB

Size: - Virtual size: 480B

Size: - Virtual size: 1KB

.imports Size: - Virtual size: 4KB

.tls Size: - Virtual size: 4KB

.W;* Size: - Virtual size: 4KB

.themida Size: - Virtual size: 6.4MB

.><l Size: - Virtual size: 1.3MB

.;,? Size: 2KB - Virtual size: 2KB

.+68 Size: 5.7MB - Virtual size: 5.7MB

.reloc Size: 5KB - Virtual size: 5KB

.rsrc Size: 512B - Virtual size: 469B

.imports
Size: - Virtual size: 4KB

.tls
Size: - Virtual size: 4KB

.W;*
Size: - Virtual size: 4KB

.themida
Size: - Virtual size: 6.4MB

.><l
Size: - Virtual size: 1.3MB

.;,?
Size: 2KB - Virtual size: 2KB

.+68
Size: 5.7MB - Virtual size: 5.7MB

.reloc
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 512B - Virtual size: 469B