Kernel Emulator og[.]exe

Resubmissions

08/08/2026, 17:04

260808-vledla1dka

08/08/2026, 17:00

260808-vjftmsee426

Sharing

Copy URL Twitter E-mail

General

Target
Kernel Emulator og.exe
Size 2.6MB
Sample260808-vledla1dka
SHA256 1d01e33d2d5456465657eeb1a98ecd1432ee7bb64278fdb4a3c33d062f803e00
MD5 863e724ff94965e92d347bfad392bdfe
SHA1 ddf357301b4c9723603b0f4a2c32cd5b365b4d4a
SHA512 942b8295921b86ea55602ed7801466b76bbbb315234a88ce268ea7fce9c54c9a72d05fe418bc1164b942a268934a89772e625024a29e771b7a66503a876a82b5
SSDEEP 49152:5f7YKVq5i7T7XF6H12WKXgJzAeUEeoYEgKg9RKxe6+n:aUDF+2gJjXlngW
TLSH
T164C5F150A2A441E8D067D1B8DDE6AA07E732740907309EEF07D09E692F67AF05F7B712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Kernel Emulator og.exe

File Explorer

Kernel Emulator og.exe

.exe 2.6MB

Kernel Emulator og.exe

IMPHASH 9b9b4d985a0a0b6421a7f5fb3d078956
SHA256 1d01e33d2d5456465657eeb1a98ecd1432ee7bb64278fdb4a3c33d062f803e00
MD5 863e724ff94965e92d347bfad392bdfe
SHA1 ddf357301b4c9723603b0f4a2c32cd5b365b4d4a
SHA512 942b8295921b86ea55602ed7801466b76bbbb315234a88ce268ea7fce9c54c9a72d05fe418bc1164b942a268934a89772e625024a29e771b7a66503a876a82b5
SSDEEP 49152:5f7YKVq5i7T7XF6H12WKXgJzAeUEeoYEgKg9RKxe6+n:aUDF+2gJjXlngW
TLSH
T164C5F150A2A441E8D067D1B8DDE6AA07E732740907309EEF07D09E692F67AF05F7B712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

647072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute

winhttp

WinHttpConnect WinHttpReceiveResponse WinHttpOpen WinHttpAddRequestHeaders WinHttpQueryHeaders WinHttpQueryOption WinHttpQueryDataAvailable WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpCrackUrl WinHttpReadData

crypt32

CertFreeCertificateChain CertGetCertificateContextProperty CertGetNameStringA CertFreeCertificateContext CertGetCertificateChain

bcrypt

BCryptDestroyKey BCryptGetProperty BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptImportKeyPair BCryptHashData BCryptSetProperty BCryptCreateHash BCryptGenerateSymmetricKey BCryptEncrypt BCryptGenRandom BCryptOpenAlgorithmProvider

advapi32

RegQueryValueExA OpenServiceA RegQueryValueExW ConvertStringSecurityDescriptorToSecurityDescriptorW OpenServiceW ChangeServiceConfigW RegOpenKeyExW RegOpenKeyExA RegQueryInfoKeyA OpenProcessToken RegSetValueExA ControlService RegCreateKeyExA OpenSCManagerA OpenSCManagerW LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey QueryServiceStatus ConvertSidToStringSidA CloseServiceHandle GetTokenInformation

shell32

ShellExecuteW

user32

DispatchMessageW GetAsyncKeyState ShowWindow wsprintfA RegisterClassExW GetWindowLongPtrW UnregisterClassW GetSystemMetrics ScreenToClient CreateWindowExW SetWindowLongPtrW GetDC DestroyWindow DefWindowProcW SetClipboardData GetClipboardData EnumWindows OpenClipboard SetCursorPos ReleaseCapture IsWindowUnicode SetLayeredWindowAttributes PeekMessageW GetWindowTextW GetCursorPos ReleaseDC SetForegroundWindow GetClientRect SetCursor SetCapture GetForegroundWindow GetKeyboardLayout TrackMouseEvent TranslateMessage FindWindowW LoadCursorW UpdateLayeredWindow EmptyClipboard UnhookWinEvent UpdateWindow SetWinEventHook SystemParametersInfoW EnumDisplaySettingsW CloseClipboard ClientToScreen GetKeyState GetMessageExtraInfo GetCapture PostQuitMessage

kernel32

HeapAlloc GetTimeZoneInformation GetConsoleOutputCP GetConsoleMode HeapFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc WaitForSingleObject GetExitCodeProcess CreateProcessW ReadConsoleW IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetStdHandle ExitProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter GetStringTypeW WakeAllConditionVariable GetCPInfo CompareStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection LCMapStringEx SleepConditionVariableSRW GetCurrentThreadId AcquireSRWLockExclusive ReleaseSRWLockExclusive InitOnceBeginInitialize IsValidCodePage GetSystemTimePreciseAsFileTime GetFileInformationByHandleEx CreateDirectoryW ReadFile GetModuleFileNameA SetConsoleCtrlHandler GetVolumeInformationW FindFirstFileW GetFileSizeEx VirtualProtect VirtualFree FindNextFileW GetFileType WriteFile ExpandEnvironmentStringsW DeviceIoControl VirtualAlloc TerminateProcess GetModuleFileNameW CreateNamedPipeW Thread32Next ExpandEnvironmentStringsA SetErrorMode SetFilePointer Thread32First GetEnvironmentVariableA FindClose CreateFileW GetFileAttributesW GetSystemDirectoryW UnmapViewOfFile GetModuleHandleA OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetTempPathA GetTickCount64 GetLastError GetFileAttributesA Process32NextW CreateFileA GetCurrentThread LoadLibraryA DeleteFileA DeleteFileW Process32FirstW CloseHandle SetFileAttributesA GetLocalTime Beep GetProcAddress LocalFree GetFileSize GetCurrentProcessId GetProcessHeap GetModuleHandleW FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime CreateFileMappingW MapViewOfFile GetTickCount LoadLibraryExW ConnectNamedPipe CheckRemoteDebuggerPresent FlushFileBuffers OutputDebugStringA GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA QueryPerformanceFrequency RtlUnwind QueryPerformanceCounter GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW AreFileApisANSI CreateFile2 SetFilePointerEx GetCurrentProcess GetFileAttributesExW FindFirstFileExW GetLocaleInfoEx FormatMessageA SetStdHandle HeapSize UnhandledExceptionFilter WriteConsoleW SetEndOfFile InitOnceComplete IsDBCSLeadByte

gdi32

CreateCompatibleDC CreateDIBSection SelectObject DeleteObject DeleteDC

ole32

CoInitializeEx CoSetProxyBlanket CoCreateInstance CoUninitialize

oleaut32

SysAllocString SysFreeString VariantInit VariantClear

iphlpapi

GetAdaptersInfo

wininet

HttpSendRequestA InternetOpenA HttpOpenRequestA InternetCloseHandle InternetConnectA InternetReadFile

gdiplus

GdipCreateBitmapFromScan0 GdipDeletePen GdipDeleteFont GdipDeleteStringFormat GdipDeleteGraphics GdipFillRectangleI GdipGetImageGraphicsContext GdipSetStringFormatAlign GdiplusStartup GdipCreateStringFormat GdipDeleteFontFamily GdipResetClip GdipAddPathArcI GdipCreateFontFamilyFromName GdipDrawString GdipDeletePath GdipDeleteRegion GdipSetSmoothingMode GdipCreatePath GdipSetStringFormatLineAlign GdipCreateFont GdipCreateSolidFill GdipResetPath GdipFillPath GdipGraphicsClear GdipCreateRegionPath GdipClosePathFigure GdipSetClipRegion GdipDrawPath GdipCreatePen1 GdipSetTextRenderingHint GdipMeasureString GdipDeleteBrush GdipDisposeImage

imm32

ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

d3dcompiler_47

D3DCompile