EmisWrath[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
EmisWrath.exe
Size 418KB
Sample260727-qx588stdme
SHA256 6ec4faf8008ebedd18d4261309bc99417b6f3a6230530a80ec2b73139822c3ab
MD5 98de126f8fa91cc2831f1145a804507e
SHA1 3f581acff37e421ff379e2e4bde4e3666d3d9ba9
SHA512 db65d00263c4182c1b87ce1377250400d16f76f86860813a9ff2fe8119892a2731516a6ea20b3004b6c4339f6d245a8f532df217bdf8fef5d99b625a2c6b7f75
SSDEEP 6144:50Pnm/SW6J5qi1pLqicnPrXsdDJYRhIVdj5Q25XcaSiS8cMl3zvAbAmohJ7tuSzI:XSW6J5qgkNXsdDJBB7pvXDznpGqZPQL
TLSH
T11794AF3AC6A65C5FF28A18F87E42517E99D59D9C0316C7BFC6723C3F8B18A842B5210D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
EmisWrath.exe

File Explorer

EmisWrath.exe

.exe 418KB

EmisWrath.exe

IMPHASH ba8f3aca763502cbc5c5d5bf9a2e1da7
SHA256 6ec4faf8008ebedd18d4261309bc99417b6f3a6230530a80ec2b73139822c3ab
MD5 98de126f8fa91cc2831f1145a804507e
SHA1 3f581acff37e421ff379e2e4bde4e3666d3d9ba9
SHA512 db65d00263c4182c1b87ce1377250400d16f76f86860813a9ff2fe8119892a2731516a6ea20b3004b6c4339f6d245a8f532df217bdf8fef5d99b625a2c6b7f75
SSDEEP 6144:50Pnm/SW6J5qi1pLqicnPrXsdDJYRhIVdj5Q25XcaSiS8cMl3zvAbAmohJ7tuSzI:XSW6J5qgkNXsdDJBB7pvXDznpGqZPQL
TLSH
T11794AF3AC6A65C5FF28A18F87E42517E99D59D9C0316C7BFC6723C3F8B18A842B5210D
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

23956

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmSetWindowAttribute

battery_plus_plugin

BatteryPlusWindowsPluginRegisterWithRegistrar

camera_windows_plugin

CameraWindowsRegisterWithRegistrar

permission_handler_windows_plugin

PermissionHandlerWindowsPluginRegisterWithRegistrar

flutter_windows

FlutterDesktopViewControllerCreate FlutterDesktopViewControllerForceRedraw FlutterDesktopViewControllerGetView FlutterDesktopMessengerUnlock FlutterDesktopMessengerLock FlutterDesktopMessengerIsAvailable FlutterDesktopMessengerRelease FlutterDesktopMessengerAddRef FlutterDesktopMessengerSetCallback FlutterDesktopMessengerSendResponse FlutterDesktopMessengerSendWithReply FlutterDesktopMessengerSend FlutterDesktopEngineSetNextFrameCallback FlutterDesktopViewControllerHandleTopLevelWindowProc FlutterDesktopEngineGetMessenger FlutterDesktopEngineGetPluginRegistrar FlutterDesktopEngineReloadSystemFonts FlutterDesktopEngineDestroy FlutterDesktopEngineCreate FlutterDesktopGetDpiForMonitor FlutterDesktopResyncOutputStreams FlutterDesktopViewGetHWND FlutterDesktopViewControllerDestroy

kernel32

GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess InitializeSListHead UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SetUnhandledExceptionFilter LoadLibraryA GetProcAddress GetModuleHandleW FreeLibrary AllocConsole WideCharToMultiByte LocalFree GetStartupInfoW GetCommandLineW AttachConsole IsDebuggerPresent

user32

RegisterClassW UnregisterClassW CreateWindowExW DestroyWindow ShowWindow MoveWindow SetWindowPos SetFocus GetClientRect GetWindowLongPtrW SetWindowLongPtrW SetParent LoadCursorW LoadIconW MonitorFromPoint GetMessageW DefWindowProcW PostQuitMessage TranslateMessage DispatchMessageW

shell32

CommandLineToArgvW

ole32

CoUninitialize CoInitializeEx

advapi32

RegGetValueW

msvcp140

?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?flags@ios_base@std@@QEBAHXZ ?good@ios_base@std@@QEBA_NXZ ?_Xbad_function_call@std@@YAXXZ ?sync_with_stdio@ios_base@std@@SA_N_N@Z ?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA ?_Xlength_error@std@@YAXPEBD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy __std_exception_copy __current_exception_context __current_exception __C_specific_handler memcmp __std_type_info_compare memmove __std_terminate memset memcpy _CxxThrowException

api-ms-win-crt-runtime-l1-1-0

_crt_atexit exit _initialize_onexit_table _get_wide_winmain_command_line _initialize_wide_environment terminate _configure_wide_argv _exit _initterm _initterm_e _cexit _invoke_watson _set_app_type _seh_filter_exe _c_exit _register_onexit_function _register_thread_local_exe_atexit_callback

api-ms-win-crt-string-l1-1-0

wcsnlen strlen wcslen

api-ms-win-crt-stdio-l1-1-0

_fileno freopen_s __acrt_iob_func _dup2 _set_fmode __p__commode

api-ms-win-crt-heap-l1-1-0

_callnewh free _set_new_mode malloc

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale