Emu[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Emu.exe
Size 288KB
Sample260803-ctkapsah75
SHA256 0035e8a7fadef984188ecdaafd7d2cd413879b7c3089c48fbdfef44993f15581
MD5 485e0c9979a65c33ba7a2cc009d5da41
SHA1 150cb586fcb518d7978f86c14a114e615dd8c08b
SHA512 2a02b71628ac20ebe48b395fd16de166b2755657511a2a747fa3fb2a8d5e1ba4cd757d6bd50249fce033ad8991d1fa7f46f2beee5ba794f1b82f92947939298a
SSDEEP 6144:CkgmdmEnGV2ddcb6Ol0OEX8+T/V0pnqg8uhqrgW:Touda6OKOEM6V0wYhqk
TLSH
T1F0546D3AE56410BCE16FC078EE93C907EF32784743B656E713D15AA12E276E49E3DA01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Emu.exe

File Explorer

Emu.exe

.exe 288KB

Emu.exe

IMPHASH 8ba19bc2e36d443bbafa26a7df7c421b
SHA256 0035e8a7fadef984188ecdaafd7d2cd413879b7c3089c48fbdfef44993f15581
MD5 485e0c9979a65c33ba7a2cc009d5da41
SHA1 150cb586fcb518d7978f86c14a114e615dd8c08b
SHA512 2a02b71628ac20ebe48b395fd16de166b2755657511a2a747fa3fb2a8d5e1ba4cd757d6bd50249fce033ad8991d1fa7f46f2beee5ba794f1b82f92947939298a
SSDEEP 6144:CkgmdmEnGV2ddcb6Ol0OEX8+T/V0pnqg8uhqrgW:Touda6OKOEM6V0wYhqk
TLSH
T1F0546D3AE56410BCE16FC078EE93C907EF32784743B656E713D15AA12E276E49E3DA01
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

163808

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\AzraVeLucky\Desktop\Auth\Emu\x64\Release\Emu.pdb

kernel32

FindNextFileA PeekNamedPipe FindClose CreateFileW Sleep GetLastError GetFileAttributesA CloseHandle LocalFree CreateProcessW ConnectNamedPipe InitializeSListHead WriteFile GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetModuleHandleW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive InitOnceBeginInitialize InitOnceComplete CreateNamedPipeW ReadFile FindFirstFileA GetModuleFileNameA GetSystemTimeAsFileTime

msvcp140

_Strcoll _Cnd_do_broadcast_at_thread_exit _Thrd_detach _Xtime_get_ticks _Mtx_unlock ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBADD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z __crtLCMapStringA ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z _Mtx_lock _Strxfrm ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?id@?$ctype@D@std@@2V0locale@2@A ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z

bcrypt

BCryptGenerateSymmetricKey BCryptSetProperty BCryptEncrypt BCryptCloseAlgorithmProvider BCryptExportKey BCryptGenRandom BCryptOpenAlgorithmProvider BCryptGenerateKeyPair BCryptDecrypt BCryptFinalizeKeyPair BCryptGetProperty BCryptDestroyKey BCryptImportKeyPair

crypt32

CryptImportPublicKeyInfoEx2 CryptStringToBinaryA CryptBinaryToStringA CryptDecodeObjectEx

ws2_32

WSAGetLastError setsockopt ioctlsocket freeaddrinfo htons htonl recv connect accept bind closesocket select listen inet_pton getaddrinfo WSAStartup send socket

secur32

InitializeSecurityContextW DecryptMessage FreeCredentialsHandle AcquireCredentialsHandleW QueryContextAttributesW DeleteSecurityContext EncryptMessage FreeContextBuffer

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __current_exception_context __current_exception memset memmove memcpy memcmp __C_specific_handler __RTtypeid strchr __std_terminate __std_type_info_compare __std_exception_copy __std_exception_destroy

api-ms-win-crt-stdio-l1-1-0

_fseeki64 fread fsetpos ungetc fputc setvbuf fgetpos fwrite _set_fmode __stdio_common_vsnprintf_s __stdio_common_vfprintf fgetc __stdio_common_vsprintf_s __acrt_iob_func fflush __p__commode _get_stream_buffer_pointers fclose

api-ms-win-crt-heap-l1-1-0

malloc free _callnewh realloc _set_new_mode

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64

api-ms-win-crt-runtime-l1-1-0

__p___argv _errno _beginthreadex _c_exit _register_thread_local_exe_atexit_callback _get_initial_narrow_environment _initterm_e system _set_app_type _seh_filter_exe _cexit _exit terminate _initterm __p___argc abort exit _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit

api-ms-win-crt-string-l1-1-0

tolower strlen

api-ms-win-crt-convert-l1-1-0

strtoull atoi strtol strtoul

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-environment-l1-1-0

_dupenv_s

api-ms-win-crt-locale-l1-1-0

___lc_collate_cp_func ___lc_locale_name_func _configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr