Static task
static1
Behavioral task
behavioral1
Sample
EMPIRES2.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
EMPIRES2.exe
Resource
win10v2004-20240802-en
General
-
Target
EMPIRES2.exe
-
Size
948KB
-
MD5
1698fcfccd04c472e9403f3b7afdbdc9
-
SHA1
573a35aeaa222a4ae5cc31a33a0874cf9d53f4b1
-
SHA256
51e45412f61427884705185149b13ae45adb67e700a810462491eb4059bf3bb7
-
SHA512
e587d9a62cd131e73fc11fa75e1aa039af1787ee5b9ea2123db922c44e991db58cb43d79eef2776e07189cc3726028f202868957a63166c94da56a92ea2c899a
-
SSDEEP
24576:lCBYMoOEcFGh9cFgz97u8iei//9vqndqoo1L/PvqLVmFe:eCOVs4Fgz97B1in9Cc19/PvqVm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource EMPIRES2.exe
Files
-
EMPIRES2.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
RDT0 Size: - Virtual size: 2.6MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
RDT1 Size: 937KB - Virtual size: 940KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.RAD32 Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE