emule[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

emule.exe
Size

5.5MB
MD5

f3f709c2d49dd6636f4ede5c2cae5448
SHA1

8e0ea03e4c38199e10a2bc12db8b2df70484111d
SHA256

06cdf814387f627a4bd05a0c68211f715bfa952423e8e8a462e1f47c11a4d20e
SHA512

7a0df912b5ddc149d770260a2e1a3f55e58ac2e9ef02883e8baa08e79261075b82955bc8e57641bb2c16983abcada2581850fafc11b92a133605127bda80513e
SSDEEP

49152:/BGoXbyOj8LePLHcPPLRCAnyOTxP9DzE4GEATLHYiipKXePi9Wxmw7b4ZC1VTWS3:rEWLHcPFCv745ATLHY1kO6g0w7b0XiG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
emule.exe

Files

emule.exe
.exe windows x86

ce0ac66cb2ee7938116324351cc8863b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapDestroy
GetStartupInfoA
SetHandleCount
GetCommandLineW
GetCommandLineA
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStdHandle
HeapSize
SetStdHandle
CreateThread
ExitThread
VirtualQuery
GetSystemInfo
VirtualAlloc
GetDateFormatA
GetTimeFormatA
PeekNamedPipe
GetFileType
TerminateProcess
GetSystemTimeAsFileTime
HeapReAlloc
RtlUnwind
GlobalFlags
SetErrorMode
VirtualProtect
TlsFree
LocalReAlloc
HeapCreate
VirtualFree
LCMapStringA
IsBadWritePtr
GetOEMCP
GetStringTypeA
GetCurrentDirectoryA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
HeapAlloc
GetDriveTypeA
SetEnvironmentVariableA
SetFilePointer
GetFileInformationByHandle
InterlockedDecrement
GlobalSize
CreateFileA
InterlockedExchange
GetACP
GetLocaleInfoA
FindClose
GetTimeZoneInformation
MulDiv
GetSystemDirectoryA
GetWindowsDirectoryA
GetModuleFileNameA
GetModuleHandleA
CompareStringA
LocalAlloc
LocalLock
LocalUnlock
SetThreadPriority
FreeResource
WaitForMultipleObjects
ResetEvent
QueryPerformanceFrequency
QueryPerformanceCounter
GetLocalTime
GetOverlappedResult
WriteFile
GetProcessHeap
TlsSetValue
TlsAlloc
TlsGetValue
GlobalHandle
GlobalReAlloc
GetCurrentThread
lstrcmpiA
ConvertDefaultLocale
HeapFree
lstrlenA
IsBadReadPtr
TerminateThread
DeviceIoControl
Beep
SetLastError
IsBadCodePtr
LocalFree
ReadFile
InterlockedIncrement
SetUnhandledExceptionFilter
GetCurrentProcessId
ExitProcess
SetEvent
ResumeThread
WritePrivateProfileStringA
GetPrivateProfileStringA
GetThreadLocale
SetThreadLocale
GlobalAlloc
GlobalFree
SetConsoleCtrlHandler
GlobalLock
GlobalUnlock
GetCurrentProcess
LoadLibraryA
FreeLibrary
RaiseException
GetFileSize
GetTickCount
GetCurrentThreadId
GetLastError
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
WaitForSingleObject
CloseHandle
Sleep
LoadResource
LockResource
SizeofResource
GetVersion
EnumResourceLanguagesW
GlobalDeleteAtom
GetVersionExA
GetFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
ReleaseMutex
DuplicateHandle
UnlockFile
LockFile
FlushFileBuffers
SuspendThread
lstrcmpA
SetEndOfFile

advapi32

CryptAcquireContextA
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
CryptReleaseContext
CryptGenRandom
RegCloseKey

user32

wsprintfA
IsWindow
IsWindowVisible
TranslateMessage
FrameRect
UpdateWindow
InvalidateRect
CreatePopupMenu
CreateIconIndirect
CopyRect
InflateRect
OffsetRect
DrawFocusRect
GetClientRect
GetActiveWindow
GetNextDlgTabItem
GetParent
WindowFromPoint
GetDlgItem
DestroyWindow
MessageBoxA
DestroyMenu
DestroyCursor
SetCursor
GetSubMenu
SetWindowPos
MapWindowPoints
ScreenToClient
SetForegroundWindow
GetCursorPos
CloseClipboard
PtInRect
DrawEdge
DrawFrameControl
SetRect
GetCapture
SetCapture
ReleaseCapture
GetMessagePos
GetWindow
GetFocus
LockWindowUpdate
GetDCEx
GetNextDlgGroupItem
DeleteMenu
SetParent
UnpackDDElParam
ReuseDDElParam
SetMenu
InvalidateRgn
SetWindowContextHelpId
MapDialogRect
EndDialog
ShowOwnedPopups
IsWindowEnabled
IsDlgButtonChecked
SetDlgItemInt
GetDlgItemInt
GetDesktopWindow
GetSysColor
FillRect
GetClassNameA
GetIconInfo
GetDC
ReleaseDC
ClientToScreen
GetWindowRect
SetTimer
ExitWindowsEx
KillTimer
IsRectEmpty
UnhookWindowsHookEx
CallNextHookEx
EmptyClipboard
SetClipboardData
EnumWindows
GetSystemMetrics
RedrawWindow
OpenClipboard
CheckRadioButton
SendDlgItemMessageA
GetForegroundWindow
GetTopWindow
GetMessageTime
DestroyIcon
GetAsyncKeyState
ScrollDC
IsChild
ChildWindowFromPointEx
SubtractRect
UnionRect
GetLastActivePopup
WaitMessage
PostQuitMessage
CheckDlgButton
SetFocus
MoveWindow
BeginPaint
EndPaint
GetDialogBaseUnits
ShowWindow
GetWindowRgn
SetWindowRgn
ShowCursor
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
SetRectEmpty
GetWindowTextA
SetDlgItemTextA
SetWindowTextA
ScrollWindow
CheckMenuRadioItem
AdjustWindowRectEx
CopyIcon
ShowScrollBar
DrawIconEx
CopyImage
SetMenuDefaultItem
EqualRect
MessageBeep
FlashWindow
SetActiveWindow
BringWindowToTop
IsIconic
GetSystemMenu
RemoveMenu
GetMenuItemCount
EnableMenuItem
CheckMenuItem
CreateMenu
DrawIcon
IntersectRect
GetDoubleClickTime
GetSysColorBrush
GetKeyState
GetWindowDC
GetMenu
IsMenu
GetScrollInfo
IsZoomed
GetMenuItemID
GetMenuState
ValidateRect
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
GetWindowPlacement
SystemParametersInfoA
GetDlgCtrlID
SetWindowPlacement
SetScrollInfo
GetScrollPos
SetScrollPos
GetScrollRange
SetScrollRange
TrackPopupMenu

gdi32

SetPixelV
SetBoundsRect
GetBitmapDimensionEx
SetBitmapDimensionEx
SetBkMode
CombineRgn
GetWindowOrgEx
GetViewportOrgEx
CreateRectRgn
Escape
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
GetMapMode
GetBkColor
GetBitmapBits
SetBitmapBits
CreateDIBSection
SetDIBColorTable
GdiFlush
CreateRectRgnIndirect
Rectangle
RealizePalette
CreatePalette
Ellipse
LPtoDP
CreateEllipticRgn
GetRgnBox
SelectPalette
CreatePatternBrush
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectClipRgn
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
SetMapMode
SetROP2
SetPolyFillMode
CreatePolygonRgn
FillRgn
OffsetRgn
SetRectRgn
SaveDC
GetClipBox
ExtSelectClipRgn
SetStretchBltMode
SetDIBitsToDevice
RestoreDC
GetDIBits
PatBlt
CreatePen
CreateSolidBrush
Polygon
SetTextAlign
GetTextColor
CreateCompatibleBitmap
GetPixel
SetPixel
CreateCompatibleDC
SelectObject
SetBkColor
BitBlt
SetTextColor
DeleteDC
GetStockObject
DPtoLP
GetDeviceCaps
CreateBitmap
CreateBrushIndirect
DeleteObject

shell32

SHGetMalloc
DragFinish
SHAppBarMessage

winmm

timeGetTime
timeGetDevCaps
timeBeginPeriod
timeEndPeriod

crypt32

CryptEncryptMessage
CertFreeCertificateContext
CertCloseStore
CertFindCertificateInStore
CertNameToStrW
CertGetNameStringW
CertGetCertificateContextProperty
CertOpenSystemStoreW

comctl32

ImageList_Remove
ImageList_Create
ImageList_DragLeave
ImageList_DragEnter
ImageList_DragShowNolock
ImageList_DragMove
ImageList_EndDrag
ImageList_BeginDrag
ImageList_GetImageCount
CreatePropertySheetPageW
DestroyPropertySheetPage
ImageList_Destroy
ImageList_AddMasked
ImageList_GetIconSize
ImageList_GetIcon
ImageList_SetOverlayImage
ImageList_DrawEx
ImageList_GetImageInfo
ImageList_Draw
ImageList_ReplaceIcon
_TrackMouseEvent
ImageList_Add
ord17
ImageList_LoadImageW
PropertySheetW
ImageList_SetBkColor

shlwapi

PathFileExistsW
PathRenameExtensionW
PathRemoveFileSpecW
PathIsRelativeW
PathRemoveExtensionW
PathFindExtensionW
PathFindFileNameW
PathRemoveBackslashW
PathAddBackslashW
PathIsURLW
PathCanonicalizeW
PathBuildRootW
PathStripToRootW
PathStripPathW
PathGetDriveNumberW
PathGetArgsW
PathIsRootW
PathCombineW
PathIsUNCW
UrlUnescapeW
PathMatchSpecW

ole32

CoCreateInstance
CoTaskMemFree
StgOpenStorage
CoTaskMemAlloc
OleSetContainedObject
OleCreateStaticFromData
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
ReleaseStgMedium
OleDuplicateData
CoInitialize
CLSIDFromProgID
CLSIDFromString
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
OleGetClipboard
CoGetClassObject
StgOpenStorageOnILockBytes
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
CoInitializeSecurity
CoUninitialize
CreateStreamOnHGlobal

oleaut32

OleCreateFontIndirect
SafeArrayGetElemsize
LoadRegTypeLi
DispCallFunc
VariantCopy
OleLoadPicture
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
SysStringLen
SafeArrayPutElement
SafeArrayDestroy
VariantChangeType
SysStringByteLen
SysAllocStringByteLen
SafeArrayGetElement
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayCreate
SysFreeString
SysAllocString
SysAllocStringLen
VariantClear
VariantInit
VariantTimeToSystemTime
SystemTimeToVariantTime

urlmon

FindMimeFromData

wininet

HttpQueryInfoW
InternetCanonicalizeUrlW
InternetReadFile
InternetCloseHandle
InternetErrorDlg
InternetOpenUrlW
InternetWriteFile
InternetSetFilePointer
InternetGetLastResponseInfoW
InternetCrackUrlW
InternetQueryDataAvailable
InternetQueryOptionW
InternetOpenW
InternetSetStatusCallbackW
InternetConnectW
HttpOpenRequestW
HttpAddRequestHeadersW
HttpSendRequestW

winspool.drv

ClosePrinter

Sections

.text
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 708KB - Virtual size: 707KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 68KB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 284KB - Virtual size: 280KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ce0ac66cb2ee7938116324351cc8863b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

user32

gdi32

shell32

winmm

crypt32

comctl32

shlwapi

ole32

oleaut32

urlmon

wininet

winspool.drv

Sections

.text Size: 3.1MB - Virtual size: 3.1MB

.rdata Size: 708KB - Virtual size: 707KB

.data Size: 68KB - Virtual size: 2.1MB

.rsrc Size: 1.3MB - Virtual size: 1.3MB

.reloc Size: 284KB - Virtual size: 280KB

.text
Size: 3.1MB - Virtual size: 3.1MB

.rdata
Size: 708KB - Virtual size: 707KB

.data
Size: 68KB - Virtual size: 2.1MB

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

.reloc
Size: 284KB - Virtual size: 280KB