omx[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
omx.exe
Size 56.6MB
Sample260820-e3wffazbmf
SHA256 4b371a0b9936b53786685156ae141afb95cbe22e138a93d818c7c50bcbe5ddb6
MD5 52c4a68cff93bd5cc84ad72ff44e4788
SHA1 341a3aec2e08095ce2d5b38087e98892a4bc2b21
SHA512 98a99ddfcbb88b9dc78b30f0bc4fb6b418f0c31639c258799f480cb376ddcdac3c90e1a231ce26f90a357163aee9cc22a0b8bd6644ba6b1ba936745ed1177808
SSDEEP 98304:WsRPTHUIN5GYt+LxXAzpE4qLrYVSt4Ytn+xAf1B:V5GYItXAzpGLoStxUAf1B
TLSH
T17CD7B43E00AA3DF7D184A19C92F36979FB30590AEF6C77E112AB447D4D19DA5083E21B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
omx.exe

File Explorer

omx.exe

.exe 56.6MB

omx.exe

IMPHASH c681d3888896082f6a1b9e8fcef0b1f6
SHA256 4b371a0b9936b53786685156ae141afb95cbe22e138a93d818c7c50bcbe5ddb6
MD5 52c4a68cff93bd5cc84ad72ff44e4788
SHA1 341a3aec2e08095ce2d5b38087e98892a4bc2b21
SHA512 98a99ddfcbb88b9dc78b30f0bc4fb6b418f0c31639c258799f480cb376ddcdac3c90e1a231ce26f90a357163aee9cc22a0b8bd6644ba6b1ba936745ed1177808
SSDEEP 98304:WsRPTHUIN5GYt+LxXAzpE4qLrYVSt4Ytn+xAf1B:V5GYItXAzpGLoStxUAf1B
TLSH
T17CD7B43E00AA3DF7D184A19C92F36979FB30590AEF6C77E112AB447D4D19DA5083E21B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3170652

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

beacon.pdb

kernel32

FreeLibrary GetFileSize LockFileEx LocalFree UnlockFile DeleteFileA CreateFileA GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW AreFileApisANSI FindNextFileW SetFilePointerEx GetExitCodeProcess WaitForMultipleObjects DuplicateHandle GetProcAddress GetModuleHandleA GetFileAttributesW CreateProcessW CancelIo CreateEventW ExitProcess GlobalLock GlobalSize WideCharToMultiByte SetWaitableTimer CreateWaitableTimerExW ReadFileEx SleepEx WriteFileEx CreateThread CopyFileExW DeleteFileW SetHandleInformation GetTempPathW GetFileInformationByHandle GetTimeZoneInformationForYear SetThreadStackGuarantee OpenProcess VirtualAllocEx WriteProcessMemory VirtualProtectEx GetCurrentProcess SwitchToThread GetSystemInfo CreateToolhelp32Snapshot Process32FirstW Process32NextW SetFileTime FindFirstFileExW GetModuleHandleW VirtualProtect GetFullPathNameW CreateDirectoryW GetOverlappedResult AddVectoredExceptionHandler GetProcessHeap HeapFree HeapReAlloc GlobalUnlock FormatMessageW WriteConsoleW WaitForSingleObject GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry LoadLibraryA lstrlenW RtlVirtualUnwind MultiByteToWideChar HeapAlloc GetEnvironmentVariableW GetModuleFileNameW QueryPerformanceFrequency GetSystemTimePreciseAsFileTime QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW LoadLibraryExA GetTickCount MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime HeapDestroy HeapCompact LoadLibraryW FlushViewOfFile OutputDebugStringW HeapSize HeapValidate UnmapViewOfFile OutputDebugStringA HeapCreate RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetConsoleOutputCP FlushFileBuffers GetConsoleMode GetStdHandle ReleaseMutex CreateMutexA SetFileInformationByHandle GetFileInformationByHandleEx GetCurrentProcessId CreateRemoteThread CloseHandle FindClose GetCurrentThread Sleep GetLastError RemoveDirectoryW GetComputerNameExW InitializeSListHead WaitForSingleObjectEx GetCurrentThreadId WriteFile CreateFileW CancelIoEx SetFileCompletionNotificationModes CreateIoCompletionPort GetQueuedCompletionStatusEx GetFinalPathNameByHandleW SetLastError ReadFile PostQueuedCompletionStatus SetUnhandledExceptionFilter

advapi32

ImpersonateAnonymousToken RevertToSelf RegCreateKeyExW SystemFunction036 RegQueryValueExW DuplicateTokenEx RegOpenKeyExW LookupPrivilegeValueW AdjustTokenPrivileges RegSetValueExW OpenProcessToken ImpersonateLoggedOnUser RegCloseKey GetUserNameW

ntdll

NtOpenFile RtlNtStatusToDosError NtCancelIoFileEx NtDeviceIoControlFile NtCreateFile NtWriteFile NtReadFile NtCreateNamedPipeFile

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

ws2_32

WSACleanup bind freeaddrinfo getsockopt connect ioctlsocket WSASocketW closesocket recv WSAIoctl send shutdown WSASend getsockname WSAGetLastError getpeername WSAStartup setsockopt getaddrinfo

oleaut32

SysFreeString SysStringLen GetErrorInfo

bcryptprimitives

ProcessPrng

user32

GetDC CloseClipboard GetAsyncKeyState GetSystemMetrics ReleaseDC GetClipboardData OpenClipboard

gdi32

DeleteDC GetDIBits BitBlt SelectObject CreateCompatibleBitmap CreateCompatibleDC DeleteObject

ncrypt

NCryptOpenKey NCryptDecrypt NCryptOpenStorageProvider

crypt32

CryptUnprotectData

bcrypt

BCryptGenRandom

vcruntime140

memmove memcmp __current_exception_context __current_exception __C_specific_handler strrchr memset memcpy strchr memchr __CxxFrameHandler3

api-ms-win-crt-string-l1-1-0

strlen strspn strncmp strcmp strcspn

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _initialize_onexit_table terminate _set_app_type _seh_filter_exe _crt_atexit _configure_narrow_argv _initialize_narrow_environment __p___argc __p___argv _get_initial_narrow_environment _c_exit _beginthreadex strerror _cexit _initterm _register_thread_local_exe_atexit_callback _exit exit _initterm_e _endthreadex

api-ms-win-crt-math-l1-1-0

__setusermatherr pow _dclass log fabs

api-ms-win-crt-heap-l1-1-0

realloc malloc _msize _set_new_mode free

api-ms-win-crt-utility-l1-1-0

_rotl64 qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale