General

  • Target

    Empress.rar

  • Size

    11.0MB

  • MD5

    22e9c9ed24cdf29b569aca396b18ae45

  • SHA1

    8df3135c39544a8637576228217f6375cd24f5c3

  • SHA256

    353b61893bff12fab8acfdff63c1fab842ba20bb918ef8dcade702372b75b953

  • SHA512

    ff7f382a2f2d427272bdf81f7dfb1f31330a7c28b7a2210d169b8edec8b52c88780c9b55d9295cba50a659016a671e4a7fbf056665012c9a337d6c7703df53c6

  • SSDEEP

    196608:YEjjLEKkou/C8zPprnvKZmsTLlq/OQzZxZT8EYVV7Z7fQCDmq/iJMMT9sufIfxC1:3Oomj0nTLl6z1TRYV9pfQbjjm+IxkQVS

Score
3/10

Malware Config

Signatures

  • Unsigned PE 12 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

Files

  • Empress.rar
    .rar

    Password: 2023

  • Empress/About/Resources/Engine_x32.dll
    .dll windows x86

    Password: 2023

    2c8b6407e1519c6ac69e454ee4a811d9


    Headers

    Imports

    Sections

  • Empress/About/Resources/Packages/ApplicationInfo.xml
    .xml
  • Empress/About/Resources/Packages/mediaservice/dsengine.dll
    .dll windows x86

    Password: 2023

    a7312b954bff8f4fced558def9dfeefc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Empress/About/Resources/Packages/mediaservice/wmfengine.dll
    .dll windows x86

    Password: 2023

    cbd57aeae18679fd290ecb4eee9ef271


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Empress/About/Resources/lgpllibs.dll
    .dll windows x64

    Password: 2023

    451aecea9f58042e76d96a82be2804fa


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Empress/About/Resources/libEGL.dll
    .dll windows x64

    Password: 2023

    733fea540c63883bb80910cfcf25367e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Empress/About/Resources/mediaservice/dsengine.dll
    .dll windows x86

    Password: 2023

    a7312b954bff8f4fced558def9dfeefc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Empress/About/Resources/mediaservice/wmfengine.dll
    .dll windows x86

    Password: 2023

    cbd57aeae18679fd290ecb4eee9ef271


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Empress/About/Resources/platforms/PresentationBuildTasks.dll
    .dll windows x86

    Password: 2023

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Empress/About/Resources/platforms/System.Speech.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Empress/About/Resources/platforms/System.Workflow.Activities.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Empress/About/Resources/platforms/System.Workflow.ComponentModel.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Empress/About/Resources/platforms/WindowsBase.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Empress/About/platforms/PresentationBuildTasks.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Empress/About/platforms/System.Speech.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Empress/About/platforms/System.Workflow.Activities.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Empress/About/platforms/System.Workflow.ComponentModel.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Empress/About/platforms/WindowsBase.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Empress/About/playlistformats/applications/AEFT/jsx/main.jsx
    .js
  • Empress/About/playlistformats/applications/DRWV/jsx/main.jsx
    .js
  • Empress/About/playlistformats/applications/FLPR/jsx/brush.jsx
    .js
  • Empress/About/playlistformats/applications/FLPR/jsx/color.jsx
    .js
  • Empress/About/playlistformats/applications/FLPR/jsx/core.jsx
    .js
  • Empress/About/playlistformats/applications/FLPR/jsx/main.jsx
    .js
  • Empress/About/playlistformats/applications/IDSN/jsx/color.jsx
    .js
  • Empress/About/playlistformats/applications/IDSN/jsx/main.jsx
    .js
  • Empress/About/playlistformats/applications/IDSN/jsx/text.jsx
    .js
  • Empress/About/playlistformats/applications/ILST/jsx/color.jsx
    .js
  • Empress/About/playlistformats/applications/ILST/jsx/main.jsx
    .js
  • Empress/About/playlistformats/applications/ILST/jsx/text.jsx
    .js
  • Empress/About/playlistformats/applications/ILST/jsx/util.jsx
    .js
  • Empress/About/playlistformats/applications/KBRG/jsx/main.jsx
    .js
  • Empress/About/playlistformats/applications/PHXS/jsx/brush.jsx
    .js
  • Empress/About/playlistformats/applications/PHXS/jsx/color.jsx
    .js
  • Empress/About/playlistformats/applications/PHXS/jsx/constants.jsx
    .js
  • Empress/About/playlistformats/applications/PHXS/jsx/gradient.jsx
    .js
  • Empress/About/playlistformats/applications/PHXS/jsx/layerstyle.jsx
    .js
  • Empress/About/playlistformats/applications/PHXS/jsx/main.jsx
    .js
  • Empress/About/playlistformats/applications/PHXS/jsx/text.jsx
    .js
  • Empress/About/playlistformats/applications/PHXS/jsx/util.jsx
    .js
  • Empress/About/playlistformats/applications/PPRO/jsx/main.jsx
    .js
  • Empress/Empress.exe
    .exe windows x86

    ced282d9b261d1462772017fe2f6972b


    Headers

    Imports

    Sections

  • Empress/Readme.txt
  • Empress/include/ansidecl.h
  • Empress/include/diagnostics.h
  • Empress/include/dis-asm.h
  • Empress/include/gdb/jit-reader.h
  • Empress/include/gnumake.h
  • Empress/include/libiberty/ansidecl.h
  • Empress/include/libiberty/demangle.h
  • Empress/include/libiberty/dyn-string.h
  • Empress/include/libiberty/fibheap.h
  • Empress/include/libiberty/floatformat.h
  • Empress/include/libiberty/hashtab.h
  • Empress/include/libiberty/libiberty.h
  • Empress/include/libiberty/objalloc.h
  • Empress/include/libiberty/partition.h
  • Empress/include/libiberty/safe-ctype.h
  • Empress/include/libiberty/sort.h
  • Empress/include/libiberty/splay-tree.h
  • Empress/include/libiberty/timeval-utils.h
  • Empress/include/libmangle.h
  • Empress/include/plugin-api.h
  • Empress/include/sim/callback.h
  • Empress/include/sim/sim.h
  • Empress/include/symcat.h
  • Empress/plc/api
    .gif
  • Empress/resources/app-update.yml