Emu[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Emu.exe
Size 157KB
Sample260804-cm9l1sen21
SHA256 a9a8135be03b1a4a1c42706e4e973c09ddfc157609ab4336367131fae9d1c937
MD5 d6b39483c34a8894a8467b01a2997093
SHA1 7c4492b1ae8baa9499acd692687dbd390d85e915
SHA512 ba9179d0c545abd79f6747c6d15fefdac4c4104d2e500754ad9cd641f99b0a5ed5e4a6b59d5e3423c2d07866374d4055da942e44a41c5a229c8c9f27439f9fb8
SSDEEP 3072:rgFnhEeACHpm08WTU+4hCjET+Y90ffI12bLccqIFO+OGHgIOnmE+QR0nzJ80:rgFSeACHpm08WTUhhCQrD2Oh+QR0nzJ5
TLSH
T164F34C37A925107DD26BD578DA575903FF32788703A1A6CB17805EF20E176E8AF3EA01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Emu.exe

File Explorer

Emu.exe

.exe 157KB

Emu.exe

IMPHASH 45a0d830845606b2483710edf1d60014
SHA256 a9a8135be03b1a4a1c42706e4e973c09ddfc157609ab4336367131fae9d1c937
MD5 d6b39483c34a8894a8467b01a2997093
SHA1 7c4492b1ae8baa9499acd692687dbd390d85e915
SHA512 ba9179d0c545abd79f6747c6d15fefdac4c4104d2e500754ad9cd641f99b0a5ed5e4a6b59d5e3423c2d07866374d4055da942e44a41c5a229c8c9f27439f9fb8
SSDEEP 3072:rgFnhEeACHpm08WTU+4hCjET+Y90ffI12bLccqIFO+OGHgIOnmE+QR0nzJ80:rgFSeACHpm08WTUhhCQrD2Oh+QR0nzJ5
TLSH
T164F34C37A925107DD26BD578DA575903FF32788703A1A6CB17805EF20E176E8AF3EA01
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

333

Minor OS version

Major OS version

Entry point

92656

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\AzraVeLucky\Desktop\Auth\Emu\x64\Release\Emu.pdb

kernel32

Sleep GetLastError CloseHandle LocalFree ConnectNamedPipe CreateFileW PeekNamedPipe CreateNamedPipeW WriteFile AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead ReleaseSRWLockExclusive ReadFile

msvcp140

_Xtime_get_ticks ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z _Strcoll ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?good@ios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBADD@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z __crtLCMapStringA ?id@?$collate@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exceptions@std@@YAHXZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Query_perf_frequency _Strxfrm _Query_perf_counter ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

bcrypt

BCryptGenerateSymmetricKey BCryptEncrypt BCryptCloseAlgorithmProvider BCryptExportKey BCryptGenRandom BCryptOpenAlgorithmProvider BCryptGenerateKeyPair BCryptFinalizeKeyPair BCryptGetProperty BCryptDestroyKey BCryptSetProperty

crypt32

CryptBinaryToStringA CryptDecodeObjectEx CryptStringToBinaryA CryptImportPublicKeyInfoEx2

ws2_32

setsockopt ioctlsocket freeaddrinfo recv connect socket send WSAStartup closesocket select getaddrinfo

secur32

InitializeSecurityContextW DecryptMessage FreeCredentialsHandle AcquireCredentialsHandleW QueryContextAttributesW DeleteSecurityContext EncryptMessage FreeContextBuffer

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __std_terminate __current_exception_context __current_exception memset memmove memcmp memcpy __RTtypeid __std_exception_destroy __std_type_info_compare __C_specific_handler __std_exception_copy strchr

api-ms-win-crt-heap-l1-1-0

realloc _callnewh _set_new_mode free malloc

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnprintf_s __stdio_common_vfprintf __stdio_common_vsprintf_s __acrt_iob_func _set_fmode __p__commode

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64

api-ms-win-crt-string-l1-1-0

strlen tolower

api-ms-win-crt-convert-l1-1-0

atoi strtol strtoul

api-ms-win-crt-runtime-l1-1-0

system _register_thread_local_exe_atexit_callback _c_exit _errno terminate _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type __p___argv _get_initial_narrow_environment _initterm _initterm_e exit _exit __p___argc

api-ms-win-crt-locale-l1-1-0

___lc_locale_name_func _configthreadlocale ___lc_collate_cp_func

api-ms-win-crt-math-l1-1-0

__setusermatherr