omega[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

omega.exe
Size

7.9MB
MD5

d57bb0db39ff23571e15c96c1dcf8879
SHA1

2a5e724e9b299355074caff738dcaa90a39ed29d
SHA256

e5a3b411fdbd22fba9c70388f0d123a0630d8c8018c38bd8f5dabed92ce10643
SHA512

4c4cff9187896eb213624d86461ad04d198b8b67b801f6e259dd9612c0e5e1965fc3819aae2e85a85302d5ee5293a7506ea3bc486d1c47c20177c815a2f166b9
SSDEEP

98304:lrhSTW393YQDSve5RopIHrpogsDMxbmY/gcKIeBOQ2w0vSOXHiOoKr2oYDOtKysv:lTfDSW5pSgstMvS0HboKr2oYDO0gU

Score

1^/10

Malware Config

Signatures

Files

omega.exe
.exe windows:6 windows x64 arch:x64

baa93d47220682c04d92f7797d9224ce

Code Sign

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bd:7b:dc:f3:b9:31:67:aa:48:b9:33:9d:b4:0c:5b:95:4d:05:d4:f1:c9:2d:85:b2:8f:a9:53:5d:4d:cf:dc:48
Signer

Actual PE Digest

bd:7b:dc:f3:b9:31:67:aa:48:b9:33:9d:b4:0c:5b:95:4d:05:d4:f1:c9:2d:85:b2:8f:a9:53:5d:4d:cf:dc:48

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

lstrcpy

comctl32

InitCommonControls

Sections

Size: 6.2MB - Virtual size: 6.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 512B - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ctmpcypf
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ocuggqpf
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

baa93d47220682c04d92f7797d9224ce

Code Sign

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:dfCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

bd:7b:dc:f3:b9:31:67:aa:48:b9:33:9d:b4:0c:5b:95:4d:05:d4:f1:c9:2d:85:b2:8f:a9:53:5d:4d:cf:dc:48Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

comctl32

Sections

Size: 6.2MB - Virtual size: 6.2MB

.rsrc Size: 1024B - Virtual size: 992B

.idata Size: 512B - Virtual size: 4KB

Size: 512B - Virtual size: 2.1MB

ctmpcypf Size: 1.7MB - Virtual size: 1.7MB

ocuggqpf Size: 512B - Virtual size: 4KB

.pdata Size: 512B - Virtual size: 4KB

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

bd:7b:dc:f3:b9:31:67:aa:48:b9:33:9d:b4:0c:5b:95:4d:05:d4:f1:c9:2d:85:b2:8f:a9:53:5d:4d:cf:dc:48
Signer

.rsrc
Size: 1024B - Virtual size: 992B

.idata
Size: 512B - Virtual size: 4KB

ctmpcypf
Size: 1.7MB - Virtual size: 1.7MB

ocuggqpf
Size: 512B - Virtual size: 4KB

.pdata
Size: 512B - Virtual size: 4KB