DllRegisterServer
Static task
static1
Behavioral task
behavioral1
Sample
emotet_epoch4.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
emotet_epoch4.dll
Resource
win10v2004-20221111-en
General
-
Target
emotet_epoch4.dll
-
Size
437KB
-
MD5
187d95b3cbe0672938a091679a6430e8
-
SHA1
7a13a15e7b9c490b80e4d0c33e11466ff1e5c594
-
SHA256
eec2550f7ef12216a457b8cf5bd3d5d296ea3189b354b8e917446c8a296453da
-
SHA512
6aff8b24c1f0955639b93a1730f07446e2bccab6bc7f0bee3a2f386544ca65dca63b5f696614f466580cde70c819cc3f0c2f288808eb6d6ce16635e2ef118755
-
SSDEEP
6144:Ypbe+TznjXD0s8gan6r+DgQlQQGk5h5q0xowArB25IwGEytJB8tF/:YpbYvA+8QllpX5H+wArMIsytUt
Malware Config
Signatures
Files
-
emotet_epoch4.dll.dll regsvr32 windows x64
8183aa82eecf5fe4b57e02215bc08c25
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CloseHandle
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
EnumSystemLocalesEx
IsValidLocaleName
LCMapStringEx
GetUserDefaultLocaleName
CompareStringEx
GetDateFormatEx
GetTimeFormatEx
HeapReAlloc
LoadLibraryW
OutputDebugStringW
SetConsoleCtrlHandler
LoadLibraryExW
FreeLibrary
FatalAppExitA
LeaveCriticalSection
GetLocaleInfoEx
GetLastError
HeapFree
HeapAlloc
EncodePointer
DecodePointer
GetCommandLineA
GetCurrentThreadId
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
IsDebuggerPresent
IsProcessorFeaturePresent
GetProcessHeap
ExitProcess
GetModuleHandleExW
GetProcAddress
AreFileApisANSI
MultiByteToWideChar
GetStdHandle
WriteFile
GetModuleFileNameW
HeapSize
Sleep
SetLastError
GetCurrentThread
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitOnceExecuteOnce
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
GetEnvironmentStringsW
FreeEnvironmentStringsW
WideCharToMultiByte
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentProcess
TerminateProcess
GetModuleHandleW
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
EnterCriticalSection
CreateFileW
user32
DispatchMessageW
DefWindowProcW
UpdateWindow
CreateWindowExW
ShowWindow
EndPaint
DestroyWindow
TranslateAcceleratorW
GetMessageW
PostQuitMessage
LoadCursorW
BeginPaint
TranslateMessage
RegisterClassExW
MessageBoxA
LoadStringW
ole32
CoCreateInstance
CoUninitialize
CoInitialize
CoLoadLibrary
CoCreateFreeThreadedMarshaler
crypt32
CryptStringToBinaryA
Exports
Exports
Sections
.text Size: 137KB - Virtual size: 136KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 281KB - Virtual size: 280KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 656B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ