OMORI[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
OMORI.exe
Size 1.6MB
Sample260919-pzyrhack9v
SHA256 a6a79c04ac729c156405399ce22c087c48b84f3f0bfaa07cb2692cd734f8fc81
MD5 60c3c8c4df1540feace6c3caa31ad45b
SHA1 38f83ec1286c01048d9b3c1d705e529bac102901
SHA512 23dc4dc7457627376e1db666ea2fbe71c5ee889d982392389d7aed854b01256895f4ecddfb3b4f5d319a94c09b45e6b28b6d6d1e9a5eff7ae3c39c2a92e103d2
SSDEEP 24576:HXVhPcthsRP/d3qI4N+Nl49LPSncvK51CvO8ofTWI4B:35RP/d6IxNIKnL5mO8ofTrQ
TLSH
T1AD755A01A462D075C6522171DC2CE6FD6B206E1DCBF248F7BAD47EEBBAB01E0353255A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
OMORI.exe

File Explorer

OMORI.exe

.exe 1.6MB

OMORI.exe

IMPHASH 01bf557f4427f3c38117e8cd2a56eebb
SHA256 a6a79c04ac729c156405399ce22c087c48b84f3f0bfaa07cb2692cd734f8fc81
MD5 60c3c8c4df1540feace6c3caa31ad45b
SHA1 38f83ec1286c01048d9b3c1d705e529bac102901
SHA512 23dc4dc7457627376e1db666ea2fbe71c5ee889d982392389d7aed854b01256895f4ecddfb3b4f5d319a94c09b45e6b28b6d6d1e9a5eff7ae3c39c2a92e103d2
SSDEEP 24576:HXVhPcthsRP/d3qI4N+Nl49LPSncvK51CvO8ofTWI4B:35RP/d6IxNIKnL5mO8ofTrQ
TLSH
T1AD755A01A462D075C6522171DC2CE6FD6B206E1DCBF248F7BAD47EEBBAB01E0353255A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

872576

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\build\nw29_win32\node-webkit\src\outst\nw\initialexe\nw.exe.pdb

nw_elf

SignalChromeElf GetInstallDetailsPayload

advapi32

ImpersonateNamedPipeClient SetEntriesInAclW GetSecurityInfo OpenProcessToken GetTokenInformation ConvertSidToStringSidW RegCreateKeyExW RegOpenKeyExW RegCloseKey RegQueryValueExW RegDeleteValueW RegSetValueExW SystemFunction036 EventRegister EventUnregister EventWrite RevertToSelf RegDisablePredefinedCache ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityDescriptorSacl SetSecurityInfo ConvertStringSidToSidW GetLengthSid SetTokenInformation GetKernelObjectSecurity GetAce SetKernelObjectSecurity DuplicateTokenEx EqualSid CreateProcessAsUserW SetThreadToken CreateRestrictedToken DuplicateToken LookupPrivilegeValueW CopySid CreateWellKnownSid

kernel32

GetThreadLocale GetSystemDefaultLCID GetCurrentThreadId GetModuleFileNameW CreateEventW GetLastError SetLastError GetCurrentProcess DuplicateHandle GetProcessId WaitForSingleObject GetCurrentDirectoryW SetCurrentDirectoryW LoadLibraryExW GetProcAddress SetProcessShutdownParameters VirtualAlloc VirtualFree MultiByteToWideChar WideCharToMultiByte ExitProcess InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetCommandLineW LocalFree GetModuleHandleW GetSystemTimeAsFileTime ReleaseSRWLockExclusive TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToSystemTime SystemTimeToTzSpecificLocalTime QueryPerformanceFrequency QueryPerformanceCounter QueryThreadCycleTime GetCurrentThread GetThreadPriority SetThreadPriority Sleep LoadLibraryW GetModuleHandleA ExpandEnvironmentStringsW CloseHandle DeleteFileW OutputDebugStringA WriteFile CreateFileW GetCurrentProcessId GetLocalTime GetTickCount FormatMessageA OpenProcess TerminateProcess GetExitCodeProcess SetFilePointerEx ReadFile GetFileSizeEx SetEndOfFile SetFileTime GetFileInformationByHandle FlushFileBuffers HeapCreate HeapDestroy UnmapViewOfFile CreateFileMappingW MapViewOfFile VirtualQuery IsDebuggerPresent RaiseException CreateThread GetThreadId TryAcquireSRWLockExclusive AcquireSRWLockExclusive GetVersionExW GetNativeSystemInfo GetFileAttributesW SetFileAttributesW RemoveDirectoryW MoveFileW ReplaceFileW CreateDirectoryW GetTempPathW GetLongPathNameW QueryDosDeviceW GetSystemDirectoryW GetWindowsDirectoryW UnregisterWaitEx RegisterWaitForSingleObject SetUnhandledExceptionFilter RtlCaptureStackBackTrace TlsGetValue HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessTimes GetModuleHandleExW GetUserDefaultLangID FreeLibrary FindClose FindNextFileW FindFirstFileExW SetEnvironmentVariableW GetEnvironmentVariableW FlushViewOfFile TlsAlloc TlsFree TlsSetValue IsWow64Process SwitchToThread CreateIoCompletionPort PostQueuedCompletionStatus SetInformationJobObject GetQueuedCompletionStatus VirtualQueryEx GetSystemInfo HeapSetInformation ResetEvent SetEvent VirtualProtect SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable InitializeCriticalSectionAndSpinCount DecodePointer CreateProcessW GetTimeZoneInformation CreateSemaphoreW ReleaseSemaphore OutputDebugStringW LockFileEx UnlockFileEx GetFileType GetStdHandle SetConsoleCtrlHandler VirtualAllocEx TerminateJobObject GetUserDefaultLCID ProcessIdToSessionId SetHandleInformation AssignProcessToJobObject WriteProcessMemory GetProcessHandleCount GetProcessHeaps SignalObjectAndWait VirtualProtectEx ReadProcessMemory VirtualFreeEx CreateNamedPipeW CreateRemoteThread CreateJobObjectW CreateMutexW SearchPathW lstrlenW DebugBreak LoadLibraryExA GetThreadContext SuspendThread TransactNamedPipe SetNamedPipeHandleState WaitNamedPipeW DisconnectNamedPipe ConnectNamedPipe GetFileInformationByHandleEx GetVersion SleepEx SetFilePointer GetThreadTimes WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage EnumSystemLocalesW IsValidLocale ResumeThread ReadConsoleW SetStdHandle GetFullPathNameW GetConsoleMode GetConsoleCP PeekNamedPipe GetDriveTypeW GetACP RtlUnwind GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW EncodePointer GetStringTypeW GetStartupInfoW InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter WaitForSingleObjectEx InitOnceExecuteOnce

psapi

GetProcessMemoryInfo GetPerformanceInfo QueryWorkingSetEx

shell32

SHGetKnownFolderPath SHGetFolderPathW CommandLineToArgvW

shlwapi

PathMatchSpecW

user32

RegisterClassW PostThreadMessageW PeekMessageW SetProcessDPIAware GetMessageW GetUserObjectInformationW CreateDesktopW SetProcessWindowStation GetThreadDesktop CreateWindowStationW GetProcessWindowStation CloseWindowStation CloseDesktop wsprintfW UnregisterClassW DefWindowProcW SetWindowLongW GetWindowLongW CreateWindowExW DestroyWindow RegisterClassExW DispatchMessageW TranslateMessage PostQuitMessage MsgWaitForMultipleObjectsEx GetQueueStatus SetTimer PostMessageW KillTimer

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

winmm

timeBeginPeriod timeGetTime timeEndPeriod

winhttp

WinHttpSetTimeouts WinHttpOpen WinHttpConnect WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest WinHttpWriteData WinHttpReadData WinHttpReceiveResponse WinHttpCloseHandle WinHttpQueryHeaders WinHttpCrackUrl

Name

.text

Size

1003KB

Virtual Size

1002KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_text32

Size

66KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

303KB

Virtual Size

302KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

213KB

Virtual Size

213KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

OMORI.exe

nw_elf

advapi32

kernel32

psapi

shell32

shlwapi

user32

version

winmm

winhttp

generic