emotet[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

emotet.dll
Size

534KB
MD5

b315345f61712ac5ff4cb92bf2e2698c
SHA1

ff3142794c982874a425526b21298f765ce375d6
SHA256

08cb232969021d39fab1aa20eb41d521c93521f33ed61f23b6f3f2d7fa1ae38c
SHA512

2d4c66577f43955b2b57cee5ac90319a8a0ce1d14b3057d3107ad35424d9880abfa73a59a9d1a42115c6cca336d03315300daad1259afdd4aa5807e0f36b72ba
SSDEEP

12288:duSNYZ/S1RIdIoOXoFt2BwOgC0/TUD9cqNJOAkoZVG:du/OBoO4uaOgAcj06

Score

N/A

Malware Config

Signatures

Files

emotet.dll
.dll regsvr32 windows x64

532692504a9f86644ae3ecaddd4c5233

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

FindResourceA
CloseHandle
CreateFileW
LoadResource
LockResource
GetCurrentProcess
GetModuleFileNameW
VirtualAllocExNuma
WriteConsoleW
SetStdHandle
LoadLibraryW
GetCurrentThreadId
FlsSetValue
GetCommandLineA
GetLastError
HeapFree
EncodePointer
DecodePointer
HeapAlloc
RaiseException
RtlPcToFileHeader
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FlsGetValue
FlsFree
SetLastError
GetCurrentThread
FlsAlloc
RtlUnwindEx
Sleep
GetProcAddress
GetModuleHandleW
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeW
HeapSize
WriteFile
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
LCMapStringW
GetUserDefaultLCID
GetLocaleInfoW
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
HeapReAlloc
SetConsoleCtrlHandler
FreeLibrary
FlushFileBuffers

user32

LoadStringW

advapi32

RegCloseKey
RegSetValueExW
RegDeleteKeyW
RegCreateKeyExW

ole32

CoTaskMemFree
StringFromCLSID

Exports

Exports

AddStroke
AddWordsToWordList
AdviseInkChange
CloneContext
CreateContext
CreateRecognizer
DestroyAlternate
DestroyContext
DestroyRecognizer
DestroyWordList
DllRegisterServer
DllUnregisterServer
GetBestResultString
GetContextPreferenceFlags
GetContextPropertyList
GetContextPropertyValue
GetEnabledUnicodeRanges
GetGuide
GetLatticePtr
GetLeftSeparator
GetPreferredPacketDescription
GetRecoAttributes
GetResultPropertyList
GetRightSeparator
GetUnicodeRanges
IsStringSupported
MakeWordList
Process
ResetContext
SetCACMode
SetContextPropertyValue
SetEnabledUnicodeRanges
SetFactoid
SetFlags
SetGuide
SetTextContext
SetWordList

Sections

.text
Size: 136KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.aarc
Size: 354KB - Virtual size: 353KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

532692504a9f86644ae3ecaddd4c5233

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

Exports

Exports

Sections

.text Size: 136KB - Virtual size: 136KB

.rdata Size: 28KB - Virtual size: 27KB

.data Size: 6KB - Virtual size: 14KB

.pdata Size: 7KB - Virtual size: 6KB

.aarc Size: 354KB - Virtual size: 353KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 136KB - Virtual size: 136KB

.rdata
Size: 28KB - Virtual size: 27KB

.data
Size: 6KB - Virtual size: 14KB

.pdata
Size: 7KB - Virtual size: 6KB

.aarc
Size: 354KB - Virtual size: 353KB

.reloc
Size: 2KB - Virtual size: 2KB