.+)��������(��z��D��7��-b ������PZ^��Cӛ���4�V� �4/���Nx�Q0�C=#G��*f͌\6LYџ�5���ooAeK �Ԧ���ޭ�~(ώ�I����o��[:0�y1:�����Q�s�c���0�w= F�Ʌd�'� ��¦F�1��������ƪ ��l����D����0^�#�8�������;�,I�&��H�����U�tkT�[�u�<pO����#�� �*s-��2���Av�,m6/��!���F��1l��N�VB�]�= I�Q_�������9���<I�� ��?K>|;��Ki���4F-�rB#�~:GL�7w���ĉ�5�`��7ʏ'� ���۞����2D:��ɟFp�����{WQ� W�#� "��}�nćZ��9�P)U�t����uI�x�+���O؆�^�gk���6�(RH�X�^�;�E�,�&���"�&���;���mFu5�n�)�^����y&��עxo��$��ynGр������8���CVe�����U�ChC�睳y?�� �;�iΤR�C���o�z��T:_S�Jy!{�5��&=��ٰD�J(uNۛGh4��e��(1�FS�M�����25�Z$0G"�~��4`�O�� �*��\���y��y�� ��t˯U��ɾ���<��%��!�H�����8��{(����,�LЅ�<�*����Y������-�_=S��%T���M��ӫd�`�jI�,�D�����N�춥x�������C�t�[�5�gV[�����A�E��>FV��z�N�a�b+: �����n�7k"��ψ�4w/>��c�w�� �rD �����C�u}+���:܈-ʏ����X��(�� ��>{$�����j$���>�!T=�'�me��o�xT��t�h�"DAAi��V����L�f�:�� �����y=��mCɐ��qD�P�@\T[Z`н��Ev�����+�8xW�(yձ�1� �D�k��}(�4��j��H�P�[|X���Y������vT3� ܌��,����W�Ŕ��F����q��w,_�Ou���y).�(4b�vĩQ�O�|�� �]M��;�����?���7�ۍ�|�uwdC��C%�Oy�W,��8:��a�χ��齼x�L6�O�=���W���R�f�-���g�N�?�$�,J4wd��<����K���ʟW���h�Q{�O��ɠt�wݤ�%.T.�o a�)���e{b���ޥġ�`�-���ɡ�"k��h�0�3��P��s�k�jG���;����{VG��ǣ��@?&[O�i%�R��V�I`����{S=wP.�i�R�&J����,��ؼ�e�(N1e���i/�� ��f'^��� �VNvw������1�KO+y�Y�d�@u��/"$�.2���M���c����:Q���/�LV��U�w��5֜r]��p6���1��YxB��E}��_�/�C�m ƣA=�+�$�2����b�2՚�v 7��>���SA�?��=ő`s���',���Dž��q��>?}$K��ƌ���\��ഓ�I���v���5��P�#2� �"�Uʑ~������x�7�����6�����]��?�tM:& �C������+W�ſ&*�G�U�`�+���g e��J��#E�RoE i�3��a���b��z.�f_�5���8���o����A/��ؓ0nL��z|���w1��y�m��*�4tNy��e3J@��Bа:�~~�ؚ ���������_���U\�7f��"ƥ�����\�%�b�e���%䕋:��R_g� �(�V��-��ӄ'�W8�W'�H"��sc��F�Xw6.���?��L �y��Ҹ�K�w�q� S�*t���%T�������+��5z2q�����_��k �#4���)ɚd�!l2NH�wpl����e�ue��¹O*�P"@��߷%?Z�נ�=s�L��yzOC綌 ���׳hhc���"�=G�UYj���Y�R-3c��xU ��on_�5��+��r%7�J�YY���3>��'�X]��c�-��qx �=�jc�"bD�z��/��N�7�`A:�&x��ۚ�ʰ��������.�t�>lL��L>���5��Sd�;�N�2/��*k,1�gu�����>o�!���T��dC�s�>[P�_����\��B�\��� J��U��;���qY���N�t=�� �!����1�xʐ6��#<}�r���"���s����^\��M�����4[Aj{ړ�I�%B���($]�~���x����%B<<�/M���`h��U�G_7x������{i��wQX9JrMc��+�|;DQ���7&Oub¢��p�|���9X�â"{��`D옦�멺m/��e����8�-l���9~�%�<��� s\ƌ "Uw�d�UԸOIM+cbճ�B�%� �(Y��$bUwz~FF�&�dQgPt+4^_O������ \�3k S�W�i��2�a�ܭ��?_9h2�th��x9p@� �I��٭x��Ca���P�ڃ����h�v�"V12<^G���xO|W������+�ʶdۢ���Jr=�Ѵiw: t~@eRӪ8�Hh�2�|�sF�zu�������GQ����v O��hķ��rm�T�J�;�;;�3[VFbO�Q��� ._������ ?�W �'V-��P�����_�[rU͍աc3�&�g"�pS�\0|W�Pm;toE�����O��������B��ƇǸeo��'v���}�E�jb�c�_\��z;���o^ú�Ϙ�����'��6�k�E�g�n.��!���5}��w��փ��k��YRܣ�wK���=%�A�̜�$J������(��δ������퉏(��M�.%�/ǙS>��~Ix5P����Q���o����j�D��_i3�-��� /F:e���Xt�E�Ɠ{:,S���2��E��5��ْs��L���$d�q��G������t�v���5 ���Fr��+��-JF�q�����1��
Static task
static1
General
-
Target
emulator.dll
-
Size
6.0MB
-
MD5
709c872725a933dc58d3bcb17ff20f43
-
SHA1
2143eac82be2eae091989e4a837065edf14d5a33
-
SHA256
0f804feeff0b4d1c976715bafb521d727b4f9ba8309ccf48cfe6f95eba346dda
-
SHA512
da086f0c3a2e4abb9e6f010f28fd80bec3bfe61b4e51f06e4c99bf6a449dcd3b3bfe1f6b10e714e20d0c86162c29670ac9ea9e6f2eb6b85060c1a51fc82d6c64
-
SSDEEP
98304:to855YDRNIE2TSNJHe+PpGsqMyO8MQscJv6CGSwb/qtD5Xa:z55YD/qSC+d8/sa6CGSs25X
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource emulator.dll
Files
-
emulator.dll.dll windows:6 windows x64 arch:x64
475703ac963bb2dd30d7678c64446120
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleFileNameA
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
CharUpperBuffW
vcruntime140
memset
api-ms-win-crt-runtime-l1-1-0
_seh_filter_dll
api-ms-win-crt-heap-l1-1-0
free
Exports
Exports
Sections
.text Size: - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
opa0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
opa1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
opa2 Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 233B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ