EMP
Static task
static1
Behavioral task
behavioral1
Sample
EMP.dll
Resource
win7-20230220-en
General
-
Target
EMP.dll
-
Size
16.5MB
-
MD5
152271c4b4ffef688f8afe097989b224
-
SHA1
df3bb0aa3f2ca3e27092b1ee2b316afa5234586f
-
SHA256
1a810d11ff37b79a348ceb52fe3a6c5b7aa83682ecff88764a78a92586c2803e
-
SHA512
33dd3768e24628294239acea1e86d158c049fb5dc937092cbe6abee77afd2c2165bedc070047ad553c01e6fae33409284d2f9a960368f17c92a83457f60a41be
-
SSDEEP
393216:6Wj4j1GtzkONfyf9Mah58FSz2pARmnfZQpeWeYO7Uy+JEMUv:6WaGtzkONk9huIRmnfZHDjIynB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource EMP.dll
Files
-
EMP.dll.dll windows x64
Password: infected
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
EMP0 Size: - Virtual size: 11.2MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
EMP1 Size: 16.5MB - Virtual size: 16.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE