General

  • Target

    EMPRESS.rar

  • Size

    11.7MB

  • MD5

    21ee536633ab421efc5e87bc191632d9

  • SHA1

    3e8ce918302d2fbbc4212999bc419022a8a6652d

  • SHA256

    7111d3d5736f75f44366de9260498d31582593d01f5aae490cc91402c3429c05

  • SHA512

    e9f348a006ab6797dfc602669bc38cb0970deb11c92f7ecb6a69e2d0be9bebf798ef1888bc2574bcf0c91de8c2db6ced91f7d98f5fe672ef54dd373f3f1f5220

  • SSDEEP

    196608:n+Sx7AnbLdMyLS8rWdK6Xuh2eACrmsVAUc7LDe2XF8cJBwNR8QVE7g/p24xsZu14:nxSb9aWkeACrBSVban8QVEkLywOT9WVO

Score
3/10

Malware Config

Signatures

  • Unsigned PE 16 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

Files

  • EMPRESS.rar
    .rar

    Password: 2023

  • EMPRESS/About/Resources/Engine_x32.dll
    .dll windows x86

    Password: 2023

    2c8b6407e1519c6ac69e454ee4a811d9


    Headers

    Imports

    Sections

  • EMPRESS/About/Resources/Packages/ApplicationInfo.xml
    .xml
  • EMPRESS/About/Resources/Packages/mediaservice/dsengine.dll
    .dll windows x86

    Password: 2023

    a7312b954bff8f4fced558def9dfeefc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • EMPRESS/About/Resources/Packages/mediaservice/wmfengine.dll
    .dll windows x86

    Password: 2023

    cbd57aeae18679fd290ecb4eee9ef271


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • EMPRESS/About/Resources/lgpllibs.dll
    .dll windows x64

    Password: 2023

    451aecea9f58042e76d96a82be2804fa


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • EMPRESS/About/Resources/libEGL.dll
    .dll windows x64

    Password: 2023

    733fea540c63883bb80910cfcf25367e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • EMPRESS/About/Resources/mediaservice/dsengine.dll
    .dll windows x86

    Password: 2023

    a7312b954bff8f4fced558def9dfeefc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • EMPRESS/About/Resources/mediaservice/wmfengine.dll
    .dll windows x86

    Password: 2023

    cbd57aeae18679fd290ecb4eee9ef271


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • EMPRESS/About/Resources/platforms/PresentationBuildTasks.dll
    .dll windows x86

    Password: 2023

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • EMPRESS/About/Resources/platforms/System.Speech.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • EMPRESS/About/Resources/platforms/System.Workflow.Activities.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • EMPRESS/About/Resources/platforms/System.Workflow.ComponentModel.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • EMPRESS/About/Resources/platforms/WindowsBase.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • EMPRESS/About/platforms/PresentationBuildTasks.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • EMPRESS/About/platforms/System.Speech.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • EMPRESS/About/platforms/System.Workflow.Activities.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • EMPRESS/About/platforms/System.Workflow.ComponentModel.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • EMPRESS/About/platforms/WindowsBase.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • EMPRESS/About/playlistformats/applications/AEFT/jsx/main.jsx
    .js
  • EMPRESS/About/playlistformats/applications/DRWV/jsx/main.jsx
    .js
  • EMPRESS/About/playlistformats/applications/FLPR/jsx/brush.jsx
    .js
  • EMPRESS/About/playlistformats/applications/FLPR/jsx/color.jsx
    .js
  • EMPRESS/About/playlistformats/applications/FLPR/jsx/core.jsx
    .js
  • EMPRESS/About/playlistformats/applications/FLPR/jsx/main.jsx
    .js
  • EMPRESS/About/playlistformats/applications/IDSN/jsx/color.jsx
    .js
  • EMPRESS/About/playlistformats/applications/IDSN/jsx/main.jsx
    .js
  • EMPRESS/About/playlistformats/applications/IDSN/jsx/text.jsx
    .js
  • EMPRESS/About/playlistformats/applications/ILST/jsx/color.jsx
    .js
  • EMPRESS/About/playlistformats/applications/ILST/jsx/main.jsx
    .js
  • EMPRESS/About/playlistformats/applications/ILST/jsx/text.jsx
    .js
  • EMPRESS/About/playlistformats/applications/ILST/jsx/util.jsx
    .js
  • EMPRESS/About/playlistformats/applications/KBRG/jsx/main.jsx
    .js
  • EMPRESS/About/playlistformats/applications/PHXS/jsx/brush.jsx
    .js
  • EMPRESS/About/playlistformats/applications/PHXS/jsx/color.jsx
    .js
  • EMPRESS/About/playlistformats/applications/PHXS/jsx/constants.jsx
    .js
  • EMPRESS/About/playlistformats/applications/PHXS/jsx/gradient.jsx
    .js
  • EMPRESS/About/playlistformats/applications/PHXS/jsx/layerstyle.jsx
    .js
  • EMPRESS/About/playlistformats/applications/PHXS/jsx/main.jsx
    .js
  • EMPRESS/About/playlistformats/applications/PHXS/jsx/text.jsx
    .js
  • EMPRESS/About/playlistformats/applications/PHXS/jsx/util.jsx
    .js
  • EMPRESS/About/playlistformats/applications/PPRO/jsx/main.jsx
    .js
  • EMPRESS/Empress.exe
    .exe windows x86

    ced282d9b261d1462772017fe2f6972b


    Headers

    Imports

    Sections

  • EMPRESS/Readme.txt
  • EMPRESS/Sourse/cs/D3Dcompiler_47.dll
    .dll windows x86

    f63cad154afed6da772d0ab361f448f6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • EMPRESS/Sourse/cs/VVXA.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • EMPRESS/Sourse/cs/universalify/LICENSE
  • EMPRESS/Sourse/cs/universalify/README.md
    .js
  • EMPRESS/Sourse/cs/universalify/index.js
    .js
  • EMPRESS/Sourse/cs/universalify/package.json
  • EMPRESS/Sourse/cs/util-deprecate/History.md
  • EMPRESS/Sourse/cs/util-deprecate/LICENSE
  • EMPRESS/Sourse/cs/util-deprecate/README.md
  • EMPRESS/Sourse/cs/util-deprecate/browser.js
    .js
  • EMPRESS/Sourse/cs/util-deprecate/node.js
  • EMPRESS/Sourse/cs/util-deprecate/package.json
  • EMPRESS/Sourse/cs/uujk.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • EMPRESS/Sourse/cs/vvks.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • EMPRESS/Sourse/cs/wrappy/LICENSE
  • EMPRESS/Sourse/cs/wrappy/README.md
    .js
  • EMPRESS/Sourse/cs/wrappy/package.json
  • EMPRESS/Sourse/cs/wrappy/wrappy.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/CHANGELOG.md
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/LICENSE
  • EMPRESS/Sourse/cs/xmlbuilder/README.md
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/appveyor.yml
  • EMPRESS/Sourse/cs/xmlbuilder/lib/Derivation.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/lib/DocumentPosition.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/lib/NodeType.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/lib/OperationType.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/lib/Utility.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/lib/WriterState.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/lib/XMLAttribute.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/lib/XMLCData.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/lib/XMLCharacterData.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/lib/XMLComment.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/lib/XMLDOMConfiguration.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/lib/XMLDOMErrorHandler.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/lib/XMLDOMImplementation.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/lib/XMLDOMStringList.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/lib/XMLDTDAttList.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/lib/XMLDTDElement.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/lib/XMLDTDEntity.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/lib/XMLDTDNotation.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/lib/XMLDeclaration.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/lib/XMLDocType.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/lib/XMLDocument.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/lib/XMLDocumentCB.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/lib/XMLDocumentFragment.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/lib/XMLDummy.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/lib/XMLElement.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/lib/XMLNamedNodeMap.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/lib/XMLNode.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/lib/XMLNodeFilter.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/lib/XMLNodeList.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/lib/XMLProcessingInstruction.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/lib/XMLRaw.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/lib/XMLStreamWriter.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/lib/XMLStringWriter.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/lib/XMLStringifier.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/lib/XMLText.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/lib/XMLTypeInfo.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/lib/XMLUserDataHandler.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/lib/XMLWriterBase.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/lib/index.js
    .js
  • EMPRESS/Sourse/cs/xmlbuilder/package.json
  • EMPRESS/Sourse/cs/xmlbuilder/typings/index.d.ts
  • EMPRESS/Sourse/cs/xmldom/.travis.yml
  • EMPRESS/Sourse/cs/xmldom/LICENSE
  • EMPRESS/Sourse/cs/xmldom/__package__.js
  • EMPRESS/Sourse/cs/xmldom/changelog
  • EMPRESS/Sourse/cs/xmldom/component.json
  • EMPRESS/Sourse/cs/xmldom/dom-parser.js
    .js
  • EMPRESS/Sourse/cs/xmldom/dom.js
    .js
  • EMPRESS/Sourse/cs/xmldom/package.json
  • EMPRESS/Sourse/cs/xmldom/readme.md
    .js
  • EMPRESS/Sourse/cs/xmldom/sax.js
    .js
  • EMPRESS/Sourse/cs/xtend/.jshintrc
  • EMPRESS/Sourse/cs/xtend/LICENSE
  • EMPRESS/Sourse/cs/xtend/README.md
    .js
  • EMPRESS/Sourse/cs/xtend/immutable.js
    .js
  • EMPRESS/Sourse/cs/xtend/mutable.js
    .js
  • EMPRESS/Sourse/cs/xtend/package.json
  • EMPRESS/Sourse/cs/xtend/test.js
    .js
  • EMPRESS/Sourse/cs/xxsa.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • EMPRESS/Sourse/cs/yauzl/LICENSE
  • EMPRESS/Sourse/cs/yauzl/README.md
    .js
  • EMPRESS/Sourse/cs/yauzl/index.js
    .js
  • EMPRESS/Sourse/cs/yauzl/package.json
  • EMPRESS/include/ansidecl.h
  • EMPRESS/include/bfd.h
  • EMPRESS/include/bfdlink.h
  • EMPRESS/include/ctf-api.h
  • EMPRESS/include/ctf.h
  • EMPRESS/include/diagnostics.h
  • EMPRESS/include/dis-asm.h
  • EMPRESS/include/gdb/jit-reader.h
  • EMPRESS/include/gnumake.h
  • EMPRESS/include/libiberty/ansidecl.h
  • EMPRESS/include/libiberty/demangle.h
  • EMPRESS/include/libiberty/dyn-string.h
  • EMPRESS/include/libiberty/fibheap.h
  • EMPRESS/include/libiberty/floatformat.h
  • EMPRESS/include/libiberty/hashtab.h
  • EMPRESS/include/libiberty/libiberty.h
  • EMPRESS/include/libiberty/objalloc.h
  • EMPRESS/include/libiberty/partition.h
  • EMPRESS/include/libiberty/safe-ctype.h
  • EMPRESS/include/libiberty/sort.h
  • EMPRESS/include/libiberty/splay-tree.h
  • EMPRESS/include/libiberty/timeval-utils.h
  • EMPRESS/include/libmangle.h
  • EMPRESS/include/plugin-api.h
  • EMPRESS/include/sim/callback.h
  • EMPRESS/include/sim/sim.h
  • EMPRESS/include/symcat.h
  • EMPRESS/plc/api
    .gif
  • EMPRESS/plc/api.work
    .js
  • EMPRESS/plc/nts
    .js
  • EMPRESS/resources/app-update.yml