emotet_exe_e5_7d448547e0cad89bd34f0fddac8a407d161d5ac389466b1bab0b785ec1dbb8ad_2022-01-13__000954[.]_exe

Resubmissions

16-03-2024 23:03

240316-21xbaaee5y 10

13-01-2022 00:09

220113-afz3wsegem 1

Sharing

Copy URL

Twitter E-mail

General

Target

emotet_exe_e5_7d448547e0cad89bd34f0fddac8a407d161d5ac389466b1bab0b785ec1dbb8ad_2022-01-13__000954._exe
Size

470KB
MD5

ec656a71699b8ce883ae4d6159b5940b
SHA1

ff7ec1f0b9c2c2df1e4a331773c32b853628dd09
SHA256

7d448547e0cad89bd34f0fddac8a407d161d5ac389466b1bab0b785ec1dbb8ad
SHA512

2029cd81824652c357eaa8edcb4c05ba3e365ffca957a4cbaa54049e35fb213162756b18edbf1e272817088d3d74f76ec8a4c73e38863c2b7484bff5bd530daa
SSDEEP

6144:Xta0vtmjG1ishZb/3QJkCrpGXtWMJw0iwg/GPAOanyCBPASUA5LtKn32OOW2ynWy:XQLHshZb/gJkCOiwEGPNCWCo2Ol2ynW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
emotet_exe_e5_7d448547e0cad89bd34f0fddac8a407d161d5ac389466b1bab0b785ec1dbb8ad_2022-01-13__000954._exe

Files

emotet_exe_e5_7d448547e0cad89bd34f0fddac8a407d161d5ac389466b1bab0b785ec1dbb8ad_2022-01-13__000954._exe
.dll regsvr32 windows:6 windows x86 arch:x86

36ed4043334e64f490ef67f21898fff6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

pdh

PdhGetFormattedCounterValue
PdhCollectQueryData
PdhCloseQuery
PdhRemoveCounter
PdhAddCounterW
PdhValidatePathW
PdhOpenQueryW

kernel32

GetCommandLineA
GetUserDefaultLangID
TlsAlloc
GetThreadLocale
GetUserDefaultUILanguage
GetCurrentThread
GetLargePageMinimum
GetEnvironmentStringsW
GetCurrentThreadId
GetSystemDefaultLangID
GetOEMCP
AreFileApisANSI
GetCurrentProcess
GetLogicalDrives
MultiByteToWideChar
RaiseException
GetLastError
InitializeCriticalSectionEx
DeleteCriticalSection
DecodePointer
EnterCriticalSection
LeaveCriticalSection
LoadResource
SizeofResource
FindResourceW
GetModuleHandleW
GetProcAddress
LoadLibraryExW
GetModuleFileNameW
lstrcmpiW
FreeLibrary
MulDiv
SetLastError
IsProcessorFeaturePresent
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
UnregisterApplicationRestart
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
FreeEnvironmentStringsW
GetCommandLineW
IsValidCodePage
FindNextFileW
FindFirstFileExW
HeapReAlloc
HeapSize
GetFileType
GetStdHandle
GetModuleHandleExW
ExitProcess
TlsFree
TlsSetValue
TlsGetValue
InitializeCriticalSectionAndSpinCount
InterlockedFlushSList
RtlUnwind
LoadLibraryExA
VirtualFree
VirtualAlloc
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
HeapFree
HeapAlloc
OutputDebugStringW
GetCPInfo
GetStringTypeW
LCMapStringEx
EncodePointer
FlushProcessWriteBuffers
UnregisterApplicationRecoveryCallback
IsDebuggerPresent
IsSystemResumeAutomatic
GetStartupInfoW
GetProcessHeap
CloseHandle
ReadFile
FindClose
GetACP
GetTickCount64
ReadConsoleW
SetStdHandle
CreateFileW
WriteConsoleW
TerminateProcess
SetUnhandledExceptionFilter
WriteFile
LocalFree
WideCharToMultiByte
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
UnhandledExceptionFilter

user32

InSendMessage
GetCapture
GetMenuCheckMarkDimensions
GetProcessWindowStation
CloseClipboard
GetMessageTime
EmptyClipboard
DestroyWindow
GetShellWindow
CallWindowProcW
DrawTextW
InsertMenuW
RegisterClassExW
LoadCursorW
GetClassInfoExW
DefWindowProcW
IsWindow
GetParent
SetTimer
ShowWindow
InvalidateRect
ReleaseDC
GetDC
EndPaint
BeginPaint
ClientToScreen
GetClientRect
SendMessageW
GetCursor
CreateWindowExW
GetWindowLongW
SetWindowLongW
CharNextW
UnregisterClassW
CountClipboardFormats
DestroyCaret
GetMessageExtraInfo
GetClipboardSequenceNumber
GetKBCodePage
GetForegroundWindow
GetClipboardViewer
GetFocus

gdi32

SetBkMode
SetTextColor
CreateFontW
DeleteDC
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
GetTextMetricsW
SelectObject
GetDeviceCaps
GdiFlush
DeleteObject

advapi32

RegDeleteValueW
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegCloseKey
RegDeleteKeyW
RegCreateKeyExW
RegOpenKeyExW

shell32

ShellExecuteW
InitNetworkAddressControl
SHGetFolderPathW

ole32

CoFreeUnusedLibraries
CoCreateInstance
CoInitialize
OleRun
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree

oleaut32

LoadRegTypeLi
LoadTypeLi
SysAllocStringLen
SysFreeString
SysAllocString
SysStringLen
VarBstrCmp
VariantInit
VariantClear
VariantCopy
VariantChangeType
VarUI4FromStr

Exports

Exports

DllRegisterServer
agcszoyjs
bahkgkxkdroklj
bkazzsdpctpmyra
dcvijtkp
ebwbczga
egmnvxfsu
ewoypwsbdapm
hmsecpcirudtpwdrb
hsmrylhuauw
iajdteucjvfcaoank
iptcbtkpsmiyvq
jesrbzi
jhzxggxvkkaehqtu
khpfutkkkmuvjr
milljqgtfxytovx
nifhpnjgwhb
pythelqvusbg
qbxvzfepxnaor

Sections

.text
Size: 229KB - Virtual size: 229KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 151KB - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

36ed4043334e64f490ef67f21898fff6

Headers

DLL Characteristics

File Characteristics

Imports

pdh

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 229KB - Virtual size: 229KB

.rdata Size: 71KB - Virtual size: 71KB

.data Size: 6KB - Virtual size: 9KB

.rsrc Size: 151KB - Virtual size: 150KB

.reloc Size: 11KB - Virtual size: 11KB

.text
Size: 229KB - Virtual size: 229KB

.rdata
Size: 71KB - Virtual size: 71KB

.data
Size: 6KB - Virtual size: 9KB

.rsrc
Size: 151KB - Virtual size: 150KB

.reloc
Size: 11KB - Virtual size: 11KB