OmesFree.zip
- SHA256 5ad442ab9bb75a04e4d178b7a44ea4963345c52574f32b63e14aab4b5e237326
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
OmesFree/config.ini
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
OmesFree/config.ini
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
OmesFree/omesfn.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
OmesFree/omesfn.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
OmesFree/skinslist.omes
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
OmesFree/skinslist.omes
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target OmesFree.zip
- Size 5.2MB
- Sample260620-rdbe7agx6x
- SHA256 5ad442ab9bb75a04e4d178b7a44ea4963345c52574f32b63e14aab4b5e237326
- MD5 739a92d06c1c505f49186dc0e229810d
- SHA1 cbe3484733da250f7320e0e22bc33f149f4f922b
- SHA512 a8c93db1b9b45f130daf78319dde6955f92203ac4a1f4bd90aa7c898e46a255e2cd62eaa2ab27868cae670aec05745f856308ac2e54c6fbf1e1f8fb2a26ec526
- SSDEEP 98304:sFZM1qZnpPVfcO72/yEC8poRUlRmyquMPLoScdgH6DgaVbHRPqe1qu5irjLx9:oZ67w2/yEC83lRhq6ScdgOgQbxbFYjLn
- TLSH T1DE46339894B471279BE48C769A13E2657AF3C15C73A70E82BD510049B3DA9B047CFCEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/OmesFree/omesfn.exe
File Explorer
-
OmesFree.zip.zip 5.2MB
-
OmesFree/config.ini615B
-
OmesFree/omesfn.exe.exe 9.4MB
-
OmesFree/skinslist.omes180KB
OmesFree/config.ini
- SHA256 2fd79742d2fc4685dc2e088efc0606355b329e77e3fdeb3d85d43266d1af6486
- MD5 15a01c8f55f2a609545d74dd868d850c
- SHA1 c7cd0b30b44403363535431dc0ccf2569fa19c19
- SHA512 4f736e22c2131834c40db4876017496c895d333698e0f6184c43c450d77f679311185e5f35e71d754311182f8f1de16d30c646abea4aa03d7f34d024acc98aba
- TLSH T1C0F0283D7AC9BA39CAB78511A9C161A221755400350B35B1B1AD41AC1B23F7824BCE0A
- MD5 SHA1 SHA512 TLSH
OmesFree/omesfn.exe
- IMPHASH c6fb30ad4dce883317a7260ffcbc1a17
- SHA256 83221a62561d6ffe4b5ae1fcd4bfee3b37dcb05e77a21a19720609555cbb3b90
- MD5 83d33bd5b34294d35b2dcce13b33fab7
- SHA1 2e11fb2a514f9b9d2812737a8baecfd907937267
- SHA512 d9ec887d322ea3b3c391b88184a525fd2b8c536d06ecb7db153150b90ca348b8a928925a389668af413e68aa38a9271a7febf90d117f3ec229c0a8005564d92f
- SSDEEP 98304:kHa2VN6/Pd4yB7kGsFHU3yEO92HJIVRiEDr2yG+aVFGEih0HUlc+0dbdnXcoGbr:k1VU/uwOdRvDrRGMEih0ocNdTwr
- TLSH T19CA67B12F98B94FBE5031A3144A7B27F67345D064B3ACBD7EB407A6AEC772914836306
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
573536
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetProcAddress
LoadLibraryExW
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetUnhandledExceptionFilter
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
ResumeThread
RaiseFailFastException
QueryPerformanceCounter
PostQueuedCompletionStatus
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
Name
.text
Size
3.2MB
Virtual Size
3.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2.9MB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
330KB
Virtual Size
32.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
/4
Size
512B
Virtual Size
340B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
559KB
Virtual Size
558KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/32
Size
99KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/46
Size
512B
Virtual Size
54B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/65
Size
898KB
Virtual Size
898KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/78
Size
549KB
Virtual Size
548KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/95
Size
237KB
Virtual Size
236KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/112
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
153KB
Virtual Size
153KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
508KB
Virtual Size
508KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
OmesFree/skinslist.omes
- SHA256 0d158b7c6a06f362229fa818cb23d101c02957aeb977518443670f6a6452b2c4
- MD5 5c6acbb4e8a3f620e13901785f3eb733
- SHA1 9404bf71ceaac2073789ec30505cfaef82f78fdb
- SHA512 20e0c6a252aca496d9c79d55c44241b848d4a82f8bd7bc876df32799916f392416195109afe1ab518fd582a1457d68d5b725124799f040067a17340b86eba6b7
- SSDEEP 3072:K8F/l7kHbAnNcEASwRk8ts+whnCFpSlOcp8oXXL7dwRrCI9bDqXbas4TwkMdFvo:5lOclbk+7Ro
- TLSH T10604BCA745FE50C3C00293EBB803828DC6D96744B107194FA6B8FD6A234758EF766D6B
- MD5 SHA1 SHA512 SSDEEP TLSH