home

omigaplus.exe

Omiga Plus

Taiwan Shui Mu Chih Ching Technology Limited

The application omigaplus.exe, “Omiga Plus application” by Taiwan Shui Mu Chih Ching Technology Limited has been detected as adware by 2 anti-malware scanners. It runs as a scheduled task under the Windows Task Scheduler. While running, it connects to the Internet address 7d.a0.a86c.ip4.static.sl-reverse.com on port 80 using the HTTP protocol.
Publisher:
Taiwan Shui Mu Chih Ching Technology Limited.  (signed by Taiwan Shui Mu Chih Ching Technology Limited)

Product:
Omiga Plus

Description:
Omiga Plus application

Version:
1.6.10.7683

MD5:
1ca88d37eb280d1940c59ec5f98467d3

SHA-1:
0103c5276976876324a61005af79653709d08f44

SHA-256:
dae1ed1310eb885d3b53c5841bf8026d5cd12b915809f4040a7cee909fbf458b

Scanner detections:
2 / 68

Status:
Adware

Analysis date:
12/24/2024 4:56:48 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Thinknice.TaiwanShuiMuChihChingTechnology
15.4.21.13

Trend Micro House Call
TROJ_GEN.F47V0731
7.2.256

File size:
1.3 MB (1,363,624 bytes)

Product version:
1.6.10.7683

Copyright:
Copyright (C) 2012

Original file name:
omigaplus.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\omiga plus\omigaplus.exe

Digital Signature
Signed by:
Taiwan Shui Mu Chih Ching Technology Limited

Authority:
GlobalSign nv-sa

Valid from:
3/13/2013 12:15:13 AM

Valid to:
3/14/2014 12:15:13 AM

Subject:
CN=Taiwan Shui Mu Chih Ching Technology Limited, O=Taiwan Shui Mu Chih Ching Technology Limited, L=新北, S=台湾, C=TW

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121243D90C81CD8FEC70E99813154FB6459

File PE Metadata
Compilation timestamp:
6/28/2013 12:25:07 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
24576:4votd5+0ME0tkUJt2Oo0gxZ4F6On7vjXrfw8dCGkvj1weN9eJ1pZqaK6vaKoxK66:UYi25xZ4F6On7vjXrfw2Ctjrzy5pZJ51

Entry address:
0x70660

Entry point:
E8, 0E, 05, 00, 00, E9, 6B, FD, FF, FF, 6A, 10, 68, C8, 47, 4E, 00, E8, 6A, 02, 00, 00, 33, C0, 89, 45, E0, 89, 45, FC, 89, 45, E4, 8B, 45, E4, 3B, 45, 10, 7D, 13, 8B, 75, 08, 8B, CE, FF, 55, 14, 03, 75, 0C, 89, 75, 08, FF, 45, E4, EB, E5, C7, 45, E0, 01, 00, 00, 00, C7, 45, FC, FE, FF, FF, FF, E8, 08, 00, 00, 00, E8, 71, 02, 00, 00, C2, 14, 00, 83, 7D, E0, 00, 75, 11, FF, 75, 18, FF, 75, E4, FF, 75, 0C, FF, 75, 08, E8, CC, FB, FF, FF, C3, CC, FF, 25, 64, E2, 4C, 00, 50, 64, FF, 35, 00, 00, 00, 00, 8D, 44...
 
[+]

Entropy:
6.2505

Code size:
817 KB (836,608 bytes)

Scheduled Task
Task name:
Omiga Plus RunAsStdUser

Trigger:
Registration (Runs on registration)

Action:
omigaplus.exe \autorun


The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to 8.81.6132.ip4.static.sl-reverse.com  (50.97.129.8:80)

TCP (HTTP):
Connects to 7d.a0.a86c.ip4.static.sl-reverse.com  (108.168.160.125:80)

TCP (HTTP):
Connects to a9.a2.a86c.ip4.static.sl-reverse.com  (108.168.162.169:80)

TCP (HTTP):
Connects to c1.2f.6132.ip4.static.sl-reverse.com  (50.97.47.193:80)

TCP (HTTP):
Connects to 208.43.232.118-static.reverse.softlayer.com  (208.43.232.118:80)

Remove omigaplus.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.