ODI2[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ODI2.exe
Size 768.1MB
Sample260812-m3vsxavfjd
SHA256 7d1cf28f8a4176d98f07c976da9fe9787321af075b16c72d15a13a9bf97a8975
MD5 b941f1327fe8d758f33cd164ce70facd
SHA1 90cb0a10906bf8d66e9fbb8a1dcf5683ee9b9cef
SHA512 9a153aa9950d4ef627cb8451fe4c23041bcd80309e298bd8fe8283725fdee48d81a113e6b7004a23d42e831ee2c044f098bd1b18b507d6c824f8ab2b10c4b94d
SSDEEP 25165824:1LGzPDc4ycyAmdtZxNP2WyrGRMPZvvwQR8Y1r:F+PAFcyRxNuJGMZvYY1r
TLSH
T1F189338036B60E4EF2E0D63421D783D4CBD54DB3367E2A6C9D864AE78F5B58CE283516
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ODI2.exe

File Explorer

ODI2.exe

.exe 768.1MB

ODI2.exe

IMPHASH ca133c207212c838a3a82165f2421166
SHA256 7d1cf28f8a4176d98f07c976da9fe9787321af075b16c72d15a13a9bf97a8975
MD5 b941f1327fe8d758f33cd164ce70facd
SHA1 90cb0a10906bf8d66e9fbb8a1dcf5683ee9b9cef
SHA512 9a153aa9950d4ef627cb8451fe4c23041bcd80309e298bd8fe8283725fdee48d81a113e6b7004a23d42e831ee2c044f098bd1b18b507d6c824f8ab2b10c4b94d
SSDEEP 25165824:1LGzPDc4ycyAmdtZxNP2WyrGRMPZvvwQR8Y1r:F+PAFcyRxNuJGMZvYY1r
TLSH
T1F189338036B60E4EF2E0D63421D783D4CBD54DB3367E2A6C9D864AE78F5B58CE283516
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

lua51

luaJIT_version_2_1_0_beta3 luaL_callmeta luaL_loadbuffer luaL_loadfile luaL_newstate luaL_openlibs luaL_traceback luaL_where lua_call lua_close lua_concat lua_cpcall lua_createtable lua_error lua_gc lua_getfield lua_gettable lua_gettop lua_insert lua_isstring lua_objlen lua_pcall lua_pushboolean lua_pushcclosure lua_pushfstring lua_pushlstring lua_pushnil lua_pushstring lua_pushvalue lua_rawgeti lua_rawseti lua_remove lua_setfield lua_sethook lua_settop lua_toboolean lua_tolstring lua_type

kernel32

DeleteCriticalSection EnterCriticalSection GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetLastError GetStartupInfoA GetSystemTimeAsFileTime GetTickCount InitializeCriticalSection LeaveCriticalSection QueryPerformanceCounter RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery

msvcrt

__C_specific_handler __getmainargs __initenv __iob_func __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _fileno _fmode _initterm _isatty _onexit abort calloc exit fflush fgets fprintf fputc fputs free fwrite getenv malloc memcpy putc signal strchr strlen strncmp strstr vfprintf

Name

.text

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

224B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1024B

Virtual Size

816B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

716B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1024B

Virtual Size

701B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ODI2.exe

lua51

kernel32

msvcrt

generic