emotet_exe_e4_e05243ec70891d75bbd33d5ac93a6a4f40adcd1d0f9e3e6f8a9cc2331b5c11c6_2022-04-28__074307[.]exe

General

Target
emotet_exe_e4_e05243ec70891d75bbd33d5ac93a6a4f40adcd1d0f9e3e6f8a9cc2331b5c11c6_2022-04-28__074307.exe
Size 413KB
Sample220428-jktaksbed9
SHA256 e05243ec70891d75bbd33d5ac93a6a4f40adcd1d0f9e3e6f8a9cc2331b5c11c6
MD5 7062ff5c1677971ebb9731101de7f256
SHA1 6aab2a185940113b2a73b87c1e1718da00f423de
SHA512 bf03065f66b9477ae64b6cbd180aebafe24126fcc6bbb0ff44257d71753a16da5bd13fdca892dcb6c4429c146a68e0e27959df398c35541c31b55c6faf682d03
SSDEEP 6144:3qGa+YH3K7gXppZo39EeKd5htWgN6DbauSU4Ko2qYyw3MUR6ytq:aGalH7Y1KHh/6DplPyw3MUxq
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

emotet_exe_e4_e05243ec70891d75bbd33d5ac93a6a4f40adcd1d0f9e3e6f8a9cc2331b5c11c6_2022-04-28__074307.exe

.dll 413KB

emotet_exe_e4_e05243ec70891d75bbd33d5ac93a6a4f40adcd1d0f9e3e6f8a9cc2331b5c11c6_2022-04-28__074307.exe

IMPHASH 7a8eae48cbeb9b498cff13262d717430
SHA256 e05243ec70891d75bbd33d5ac93a6a4f40adcd1d0f9e3e6f8a9cc2331b5c11c6
MD5 7062ff5c1677971ebb9731101de7f256
SHA1 6aab2a185940113b2a73b87c1e1718da00f423de
SHA512 bf03065f66b9477ae64b6cbd180aebafe24126fcc6bbb0ff44257d71753a16da5bd13fdca892dcb6c4429c146a68e0e27959df398c35541c31b55c6faf682d03
SSDEEP 6144:3qGa+YH3K7gXppZo39EeKd5htWgN6DbauSU4Ko2qYyw3MUR6ytq:aGalH7Y1KHh/6DplPyw3MUxq
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows x64

Minor OS version

Major OS version

Entry point

156252

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetCurrentProcess ExitProcess WriteConsoleW CloseHandle CreateFileW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx InterlockedFlushSList GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetModuleHandleExW GetModuleFileNameW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetProcessHeap GetStdHandle GetFileType GetStringTypeW HeapSize HeapReAlloc SetStdHandle FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode SetFilePointerEx

ntdll

NtCreateSection NtMapViewOfSection pow __chkstk

Name

.text

Size

201KB

Virtual Size

201KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

162KB

Virtual Size

162KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

emotet_exe_e4_e05243ec70891d75bbd33d5ac93a6a4f40adcd1d0f9e3e6f8a9cc2331b5c11c6_2022-04-28__074307.exe

kernel32

ntdll