Emily cheat[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Emily cheat.zip
Size 4.5MB
Sample260810-jraf2sdm91
SHA256 7fe19130feca321e5b453012f2acd989b9eee4a5ff4a34c0c10a7e1d534a37ae
MD5 ae4bda21f63ff50d00dc75d61f814367
SHA1 fb6cf03b107b9b1e33713608e2400925aa999d82
SHA512 77ebb87dabf57fc268b592ff52009b3c1aba6b91b7e990c7771f6da2a57c53e9e77d47583d48c0d71c5070885bb6cb8504f640b8df0f6df08adcd13944ec9965
SSDEEP 98304:gFeivp3s935QLt8fviq7toxpIFusIwlnEhzXcNo9QN/CteX+DlE09l:mBs6Luviq7tAIIsIwczXi6tFDaO
TLSH
T1EB2633CD9326EAC38A0CC45D0F603C89A34EB608DC119DE7A0A59F1D46665D70AF7BE7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Emily cheat.exe

File Explorer

Emily cheat.zip

.zip 4.5MB
Emily cheat.exe

.exe 10.7MB

Emily cheat.zip

SHA256 7fe19130feca321e5b453012f2acd989b9eee4a5ff4a34c0c10a7e1d534a37ae
MD5 ae4bda21f63ff50d00dc75d61f814367
SHA1 fb6cf03b107b9b1e33713608e2400925aa999d82
SHA512 77ebb87dabf57fc268b592ff52009b3c1aba6b91b7e990c7771f6da2a57c53e9e77d47583d48c0d71c5070885bb6cb8504f640b8df0f6df08adcd13944ec9965
SSDEEP 98304:gFeivp3s935QLt8fviq7toxpIFusIwlnEhzXcNo9QN/CteX+DlE09l:mBs6Luviq7tAIIsIwczXi6tFDaO
TLSH
T1EB2633CD9326EAC38A0CC45D0F603C89A34EB608DC119DE7A0A59F1D46665D70AF7BE7
MD5 SHA1 SHA512 SSDEEP TLSH

Emily cheat.exe

IMPHASH 4e2bd2c481372f7ab13b83b63b424e97
SHA256 ccc47f4e65a25d64a2ad42e7ff2dcf52018ebc1cc7030361eef02b0efa628dfa
MD5 a9fb7dab1178ebb528a43b53683002fe
SHA1 5683842c0992ca9b4639bb0b786e7b9478f18857
SHA512 3f41de9a18203925c2cfcf7e1ca4cf64628a4fb70a525c53b6804f874ce2311264d05f5a75f8c95f6652ce8ea260c23f75f964b89a8c762c6c6d0fa1df4d2ad4
SSDEEP 98304:l91TzcZzHDxKOfi9VIIlqx2NumvBh8huTjEG:lfINALOIlahG
TLSH
T1E5B64943ECA501E9C1ADC575CA2A9616BB713C894B30A3DB5B50F7252F37BD0AEB9700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

557184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

5.2MB

Virtual Size

5.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.8MB

Virtual Size

4.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

494KB

Virtual Size

32.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

122KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

74KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Emily cheat.zip

Emily cheat.exe

kernel32

generic