eM9B8[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

eM9B8.exe
Size

14.5MB
MD5

eab6e76a28a3d2b4be65789ca1d33574
SHA1

eb25bc13095e525b4d13497b0c008487d74cb483
SHA256

5f8da4b421d0cc5c29a25b55469e5e34d7fdb0fe0e7ba075b314912011ca7242
SHA512

eb3954f870789a6185e72697a6e9b32751ff97d2c860d6dd9a12cfdad2e4fa7e88901fad290e079c315a30cfe2e6725b68c96e4f813d48cc2ad833da9c565111
SSDEEP

196608:3zLVd9eBtrSdC/MqtI7cbYmwfSI7zCD+kfStJPyHnnyCtdlsor7y7dpw7:3zpeBNMZ/7Oo6+/JPyHnFkWI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eM9B8.exe

Files

eM9B8.exe
.exe windows:6 windows x64 arch:x64

bc12bacceef5659d86e2cdfb69af51c1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CheckRemoteDebuggerPresent
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress

user32

BlockInput

ole32

CoCreateInstance

oleaut32

SysAllocString

shell32

ShellExecuteW

d3d9

Direct3DCreate9Ex

advapi32

CloseServiceHandle

imm32

ImmGetContext

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ

ws2_32

WSACleanup

urlmon

URLDownloadToFileW

ntdll

NtQuerySystemInformation

vcruntime140

_CxxThrowException

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func

api-ms-win-crt-heap-l1-1-0

_aligned_free

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-runtime-l1-1-0

__p___argc

api-ms-win-crt-time-l1-1-0

_localtime64

api-ms-win-crt-filesystem-l1-1-0

_lock_file

api-ms-win-crt-string-l1-1-0

_strdup

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-utility-l1-1-0

qsort

Sections

jR��&d
Size: - Virtual size: 650KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PH� ��
Size: - Virtual size: 223KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

�azL[O?
Size: - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

��%�i
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

�� c��?�
Size: - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

�0}r>f
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

+�;Q{�
Size: - Virtual size: 38B

'�cza
Size: - Virtual size: 9.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

#�2�o�i
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

23M��
Size: 14.5MB - Virtual size: 14.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

�.�+Y|
Size: 512B - Virtual size: 280B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

:gan%t
Size: 512B - Virtual size: 422B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bc12bacceef5659d86e2cdfb69af51c1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ole32

oleaut32

shell32

d3d9

advapi32

imm32

msvcp140

ws2_32

urlmon

ntdll

vcruntime140

vcruntime140_1

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

Sections

jR��&d Size: - Virtual size: 650KB

PH� ��� Size: - Virtual size: 223KB

�azL[O ? Size: - Virtual size: 61KB

���%�i Size: - Virtual size: 20KB

�� c��?� Size: - Virtual size: 40B

 �0}r>f Size: - Virtual size: 4KB

+�;Q{� Size: - Virtual size: 38B

'�cz a Size: - Virtual size: 9.3MB

#�2�o�i Size: 9KB - Virtual size: 9KB

23M�� Size: 14.5MB - Virtual size: 14.5MB

�.�+Y| Size: 512B - Virtual size: 280B

:gan%t Size: 512B - Virtual size: 422B

jR��&d
Size: - Virtual size: 650KB

PH� ��
Size: - Virtual size: 223KB

�azL[O?
Size: - Virtual size: 61KB

��%�i
Size: - Virtual size: 20KB

�� c��?�
Size: - Virtual size: 40B

�0}r>f
Size: - Virtual size: 4KB

+�;Q{�
Size: - Virtual size: 38B

'�cza
Size: - Virtual size: 9.3MB

#�2�o�i
Size: 9KB - Virtual size: 9KB

23M��
Size: 14.5MB - Virtual size: 14.5MB

�.�+Y|
Size: 512B - Virtual size: 280B

:gan%t
Size: 512B - Virtual size: 422B