FREE NO RESTART EMULATOR[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
FREE NO RESTART EMULATOR.exe
Size 3.8MB
Sample260716-t9sepadt2z
SHA256 b431b440c8863cc49647fcfa786f7e17c1df7d29f32bb9ecf5819c1c6fe4becb
MD5 638c632c15be0abb89dd39e1a681b157
SHA1 4e0bdbf18804350208cd72d3610b487673057421
SHA512 55fdda3cd1db55514a4be14fc1c474b2a423fc2758321f4fb26f39ef4f9ec2868a50a1e2f92dfaec35b2c9b3605385d89a8d3d849c0410e7248bbe50890f0f01
SSDEEP 98304:LYPJXWIsiIGHzydGSYAlQxuv43UyLtAgW:LY7siIGHzydGS90AgW
TLSH
T1CF06CF03A3A341ECC1279638C716AB1BE73278050321DBCF67841AA59F536E55FBB798
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FREE NO RESTART EMULATOR.exe

File Explorer

FREE NO RESTART EMULATOR.exe

.exe 3.8MB

FREE NO RESTART EMULATOR.exe

IMPHASH d3a0e54590487ff4618a3ec284dd8ce2
SHA256 b431b440c8863cc49647fcfa786f7e17c1df7d29f32bb9ecf5819c1c6fe4becb
MD5 638c632c15be0abb89dd39e1a681b157
SHA1 4e0bdbf18804350208cd72d3610b487673057421
SHA512 55fdda3cd1db55514a4be14fc1c474b2a423fc2758321f4fb26f39ef4f9ec2868a50a1e2f92dfaec35b2c9b3605385d89a8d3d849c0410e7248bbe50890f0f01
SSDEEP 98304:LYPJXWIsiIGHzydGSYAlQxuv43UyLtAgW:LY7siIGHzydGS90AgW
TLSH
T1CF06CF03A3A341ECC1279638C716AB1BE73278050321DBCF67841AA59F536E55FBB798
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1470944

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\moun1x\Desktop\New folder\emu imgui\thirdparty\imgui\examples\example_win32_directx11\Release\example_win32_directx11.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

winhttp

WinHttpOpen WinHttpSetOption WinHttpSetTimeouts WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpReceiveResponse WinHttpReadData WinHttpQueryDataAvailable WinHttpConnect WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest

bcrypt

BCryptEncrypt BCryptDestroyKey BCryptGetProperty BCryptFinalizeKeyPair BCryptDecrypt BCryptGenerateKeyPair BCryptOpenAlgorithmProvider BCryptExportKey BCryptGenerateSymmetricKey BCryptSetProperty BCryptImportKeyPair BCryptCloseAlgorithmProvider BCryptGenRandom

crypt32

CertFreeCertificateChain PFXImportCertStore CryptDecodeObjectEx CertCreateSelfSignCertificate CertFreeCertificateContext CryptStringToBinaryA PFXExportCertStore CertCloseStore CertStrToNameA CryptImportPublicKeyInfoEx2 CertFindCertificateInStore CertOpenStore CertEnumCertificatesInStore CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptStringToBinaryW

advapi32

RegCloseKey CryptAcquireContextW CryptCreateHash CryptHashData CryptDestroyHash RegOpenKeyExW CryptGetHashParam RegQueryValueExW CryptReleaseContext CloseServiceHandle SystemFunction036 CryptEncrypt CryptImportKey CryptDestroyKey OpenSCManagerW ControlService OpenServiceW

ws2_32

closesocket inet_pton freeaddrinfo select listen connect WSAStartup inet_addr getaddrinfo send accept inet_ntop getsockopt socket WSACleanup recv gethostname ioctlsocket htons sendto recvfrom setsockopt bind WSACloseEvent __WSAFDIsSet WSACreateEvent WSAGetLastError WSAEnumNetworkEvents WSAIoctl getsockname getpeername WSAEventSelect WSASetLastError htonl ntohs

secur32

FreeContextBuffer InitializeSecurityContextW QueryContextAttributesW DecryptMessage AcceptSecurityContext EncryptMessage FreeCredentialsHandle DeleteSecurityContext AcquireCredentialsHandleW

kernel32

SleepConditionVariableSRW WakeAllConditionVariable SetUnhandledExceptionFilter WriteFile GetTempPathA CreateFileA GlobalAlloc GlobalLock GetCurrentProcessId WinExec GlobalUnlock ReadFile SetNamedPipeHandleState PeekNamedPipe GetEnvironmentVariableA Sleep DeleteFileA ExitProcess CreateDirectoryA GetModuleFileNameA FillConsoleOutputCharacterA SetConsoleCtrlHandler GetVolumeInformationW GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle DeviceIoControl CreateNamedPipeW CreateFileW GetSystemDirectoryW CreateToolhelp32Snapshot GetLastError Process32NextW Process32FirstW FillConsoleOutputAttribute LocalFree GetComputerNameW GetSystemTime SetConsoleCursorPosition SetConsoleTitleW ConnectNamedPipe GetExitCodeProcess HeapFree InitializeCriticalSectionEx GetCurrentThreadId UnmapViewOfFile GetModuleHandleA HeapAlloc DeleteCriticalSection GetModuleHandleW MapViewOfFile QueryPerformanceCounter WideCharToMultiByte GetLocaleInfoA MultiByteToWideChar LoadLibraryA QueryPerformanceFrequency GetProcAddress VerSetConditionMask FreeLibrary GlobalFree ReleaseSRWLockExclusive AcquireSRWLockExclusive SetLastError FormatMessageW EnterCriticalSection LeaveCriticalSection LoadLibraryW SleepEx GetTickCount MoveFileExW WaitForSingleObjectEx GetFileType WaitForMultipleObjects VerifyVersionInfoW GetFileSizeEx InitializeCriticalSection CreateFileMappingA OutputDebugStringW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetSystemInfo GetStartupInfoW CloseHandle

user32

GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect GetClipboardData ReleaseCapture SetCursorPos GetCursorPos UnregisterClassW SetWindowPos SendMessageW GetSystemMetrics ShowWindow UpdateWindow MessageBoxA wsprintfA GetWindowRect OpenClipboard CloseClipboard EmptyClipboard SetClipboardData PostQuitMessage TranslateMessage SetLayeredWindowAttributes PeekMessageW GetKeyState DispatchMessageW RegisterClassExW CreateWindowExW DestroyWindow DefWindowProcW IsWindowUnicode

shell32

ShellExecuteA

msvcp140

??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??Bios_base@std@@QEBA_NXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z _Strcoll ?id@?$collate@D@std@@2V0locale@2@A ?id@?$ctype@D@std@@2V0locale@2@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z __crtLCMapStringA ?tolower@?$ctype@D@std@@QEBADD@Z ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ ?_Xlength_error@std@@YAXPEBD@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?good@ios_base@std@@QEBA_NXZ ?_Xbad_alloc@std@@YAXXZ _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?_Xout_of_range@std@@YAXPEBD@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_id _Query_perf_counter _Thrd_join _Mtx_unlock ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z _Thrd_detach ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ _Xtime_get_ticks _Strxfrm

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __intrinsic_setjmp __current_exception_context __current_exception longjmp wcschr __std_exception_destroy __std_exception_copy __std_terminate __std_type_info_compare strchr __RTtypeid __C_specific_handler strstr memcpy memset strrchr memmove memcmp memchr

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free _set_new_mode realloc calloc

api-ms-win-crt-string-l1-1-0

tolower _wcsicmp strcspn strncmp wcspbrk strspn strcmp wcsncmp strpbrk strcpy_s isalnum wcsncpy strncpy _strdup strcat_s toupper strlen wcslen

api-ms-win-crt-stdio-l1-1-0

fputc _close _fileno _write _read fflush __p__commode _set_fmode fclose fgetc _lseeki64 fwrite fgetpos _wopen setvbuf ungetc fsetpos feof fputs fread _fseeki64 _get_stream_buffer_pointers __stdio_common_vsscanf _wfopen __stdio_common_vfprintf fseek __acrt_iob_func ftell __stdio_common_vsprintf_s fgets __stdio_common_vsprintf

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _initialize_narrow_environment _get_narrow_winmain_command_line _initterm _initterm_e _exit _wassert _c_exit _register_thread_local_exe_atexit_callback _configure_narrow_argv __sys_nerr terminate __sys_errlist _initialize_onexit_table system exit abort _errno _beginthreadex

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64 strftime _localtime64_s

api-ms-win-crt-convert-l1-1-0

strtoll strtol atoi strtoul wcstombs

api-ms-win-crt-filesystem-l1-1-0

_fstat64 _wstat64 _unlink _lock_file _unlock_file

api-ms-win-crt-math-l1-1-0

powf _fdopen sinf sqrtf acosf ceilf cosf fmodf __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_collate_cp_func ___lc_locale_name_func

api-ms-win-crt-utility-l1-1-0

qsort