EMP[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

EMP.dll
Size

1.6MB
MD5

940525d0b9c97478771c54296b3b201b
SHA1

41dce37e605f990d36416745ceaa3bebc049de37
SHA256

162b275e696f3cddb32198d679f0c18514368986f782094219b61e244e95e8c6
SHA512

641c81b35c63a1213ef859852de7ddb24c0a9f411f9254a6329547039b68d5ad244aa9acc24875be55d4fd3b5a061db818a06b646aa6e3135c51b6b3bc642382
SSDEEP

24576:/qAruQLKTxGotu8rpNF5F/6VNib5XZttTa7KBMd5F7xenPJnJODJS9zUoSzN:/qAruuKgo0qGiba7KCEJma3S

Score

1^/10

Malware Config

Signatures

Files

EMP.dll
.dll windows:6 windows x64 arch:x64

fc7124d57387852c0a6a634e9130bf57

Code Sign

33:00:00:02:5c:93:5a:76:bd:10:e5:99:96:00:00:00:00:02:5c
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

31-01-2020 19:26

Not After

22-01-2021 19:26

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

93:5c:8a:cd:6b:f5:38:2a:ab:ea:98:b2:33:07:27:b2:64:a0:99:93:71:c5:f1:3b:31:24:a6:03:49:fa:59:8a
Signer

Actual PE Digest

93:5c:8a:cd:6b:f5:38:2a:ab:ea:98:b2:33:07:27:b2:64:a0:99:93:71:c5:f1:3b:31:24:a6:03:49:fa:59:8a

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

IsDebuggerPresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsProcessorFeaturePresent
LoadLibraryA
UnhandledExceptionFilter
GetProcAddress
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

Exports

Exports

EMP

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 372B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.emp0
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data2
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.EMP
Size: 204KB - Virtual size: 204KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.emp1
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 233B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fc7124d57387852c0a6a634e9130bf57

Code Sign

33:00:00:02:5c:93:5a:76:bd:10:e5:99:96:00:00:00:00:02:5cCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

93:5c:8a:cd:6b:f5:38:2a:ab:ea:98:b2:33:07:27:b2:64:a0:99:93:71:c5:f1:3b:31:24:a6:03:49:fa:59:8aSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 3KB - Virtual size: 3KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 208B

.pdata Size: 512B - Virtual size: 372B

.emp0 Size: 512B - Virtual size: 248B

.data2 Size: 92KB - Virtual size: 92KB

.EMP Size: 204KB - Virtual size: 204KB

.emp1 Size: 1.3MB - Virtual size: 1.3MB

.reloc Size: 512B - Virtual size: 128B

.rsrc Size: 512B - Virtual size: 233B

33:00:00:02:5c:93:5a:76:bd:10:e5:99:96:00:00:00:00:02:5c
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

93:5c:8a:cd:6b:f5:38:2a:ab:ea:98:b2:33:07:27:b2:64:a0:99:93:71:c5:f1:3b:31:24:a6:03:49:fa:59:8a
Signer

.text
Size: 3KB - Virtual size: 3KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 208B

.pdata
Size: 512B - Virtual size: 372B

.emp0
Size: 512B - Virtual size: 248B

.data2
Size: 92KB - Virtual size: 92KB

.EMP
Size: 204KB - Virtual size: 204KB

.emp1
Size: 1.3MB - Virtual size: 1.3MB

.reloc
Size: 512B - Virtual size: 128B

.rsrc
Size: 512B - Virtual size: 233B