Emu[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Emu.exe
Size 198KB
Sample260802-fa5dbavcrd
SHA256 81b98a50bc77faedb655fa647eefeff3869b3f79a7806c73e08efb696822194c
MD5 b5509c17f25c65c50d7451bd7956951d
SHA1 f28e5bf3c37eebc2d8eafbdabe166a46168fdc35
SHA512 7c9eaab31b1045eeefb3f8ed5c117935daa87eecba74f2c11703583a3cbc93031f03006dfe3c9188d5524cba6b6a8ea822ae298014e27d7eba9dd691a2f3dba2
SSDEEP 3072:mgYXQ7HVpmU8PTXTRDeclwPsYOm9zFdIjgNBbD8SL9KReZovCNANkhteCIoTYAKT:mgYQHVpmU8PTXTVec6Hg8nrOzJ8k
TLSH
T191146C36AD2450BDD36AC079FA53DD02EF32784B4365E6DB17801AB10E176E99E3EB01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Emu.exe

File Explorer

Emu.exe

.exe 198KB

Emu.exe

IMPHASH 45a0d830845606b2483710edf1d60014
SHA256 81b98a50bc77faedb655fa647eefeff3869b3f79a7806c73e08efb696822194c
MD5 b5509c17f25c65c50d7451bd7956951d
SHA1 f28e5bf3c37eebc2d8eafbdabe166a46168fdc35
SHA512 7c9eaab31b1045eeefb3f8ed5c117935daa87eecba74f2c11703583a3cbc93031f03006dfe3c9188d5524cba6b6a8ea822ae298014e27d7eba9dd691a2f3dba2
SSDEEP 3072:mgYXQ7HVpmU8PTXTRDeclwPsYOm9zFdIjgNBbD8SL9KReZovCNANkhteCIoTYAKT:mgYQHVpmU8PTXTVec6Hg8nrOzJ8k
TLSH
T191146C36AD2450BDD36AC079FA53DD02EF32784B4365E6DB17801AB10E176E99E3EB01
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

92624

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\AzraVeLucky\Desktop\Auth\Emu\x64\Release\Emu.pdb

kernel32

Sleep GetLastError CloseHandle LocalFree ConnectNamedPipe CreateFileW PeekNamedPipe CreateNamedPipeW WriteFile AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead ReleaseSRWLockExclusive ReadFile

msvcp140

_Xtime_get_ticks ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z _Strcoll ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?good@ios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBADD@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z __crtLCMapStringA ?id@?$collate@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exceptions@std@@YAHXZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Query_perf_frequency _Strxfrm _Query_perf_counter ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

bcrypt

BCryptGenerateSymmetricKey BCryptEncrypt BCryptCloseAlgorithmProvider BCryptExportKey BCryptGenRandom BCryptOpenAlgorithmProvider BCryptGenerateKeyPair BCryptFinalizeKeyPair BCryptGetProperty BCryptDestroyKey BCryptSetProperty

crypt32

CryptBinaryToStringA CryptDecodeObjectEx CryptStringToBinaryA CryptImportPublicKeyInfoEx2

ws2_32

setsockopt ioctlsocket freeaddrinfo recv connect socket send WSAStartup closesocket select getaddrinfo

secur32

InitializeSecurityContextW DecryptMessage FreeCredentialsHandle AcquireCredentialsHandleW QueryContextAttributesW DeleteSecurityContext EncryptMessage FreeContextBuffer

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __std_terminate __current_exception_context __current_exception memset memmove memcmp memcpy __RTtypeid __std_exception_destroy __std_type_info_compare __C_specific_handler __std_exception_copy strchr

api-ms-win-crt-heap-l1-1-0

realloc _callnewh _set_new_mode free malloc

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnprintf_s __stdio_common_vfprintf __stdio_common_vsprintf_s __acrt_iob_func _set_fmode __p__commode

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64

api-ms-win-crt-string-l1-1-0

strlen tolower

api-ms-win-crt-convert-l1-1-0

atoi strtol strtoul

api-ms-win-crt-runtime-l1-1-0

system _register_thread_local_exe_atexit_callback _c_exit _errno terminate _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type __p___argv _get_initial_narrow_environment _initterm _initterm_e exit _exit __p___argc

api-ms-win-crt-locale-l1-1-0

___lc_locale_name_func _configthreadlocale ___lc_collate_cp_func

api-ms-win-crt-math-l1-1-0

__setusermatherr