Emu (1)[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Emu (1).exe
Size 248KB
Sample260813-e2eras1grg
SHA256 a89d50884b1f12fed4811803625a270e132555d013d26c211907fd8e480830e8
MD5 db0272f22913973dd0e10a4ce7682580
SHA1 c5c5819c4996a291042bdd819c16fcf0cb505856
SHA512 c8bda14715b9081122104a6824ff31053bc68bcb37531339753f6b21f0cadcd5b5abf1d83864d53ee7f156932945b415ae807a645188e60c8cd29517f4b121e8
SSDEEP 6144:NDgfruqoTsl/t/8ATCH1rplg8H6Oq4g+fF:Njhgl/t09HrlZVqluF
TLSH
T175447C3DBA280CBDDA6EC079EE83C906DF327C474365D6D713905AA20E176E59E3DA01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Emu (1).exe

File Explorer

Emu (1).exe

.exe 248KB

Emu (1).exe

IMPHASH 4a25eca2c378d943d75e5e8fdda4da7f
SHA256 a89d50884b1f12fed4811803625a270e132555d013d26c211907fd8e480830e8
MD5 db0272f22913973dd0e10a4ce7682580
SHA1 c5c5819c4996a291042bdd819c16fcf0cb505856
SHA512 c8bda14715b9081122104a6824ff31053bc68bcb37531339753f6b21f0cadcd5b5abf1d83864d53ee7f156932945b415ae807a645188e60c8cd29517f4b121e8
SSDEEP 6144:NDgfruqoTsl/t/8ATCH1rplg8H6Oq4g+fF:Njhgl/t09HrlZVqluF
TLSH
T175447C3DBA280CBDDA6EC079EE83C906DF327C474365D6D713905AA20E176E59E3DA01
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

130176

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\AzraVeLucky\Desktop\Auth\Emu\x64\Release\Emu.pdb

kernel32

PeekNamedPipe FindClose CreateFileW Sleep GetLastError CloseHandle LocalFree ConnectNamedPipe InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId FindNextFileA QueryPerformanceCounter GetModuleHandleW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive InitOnceBeginInitialize InitOnceComplete ReadFile CreateNamedPipeW WriteFile FindFirstFileA GetCurrentProcessId

msvcp140

_Strcoll _Cnd_do_broadcast_at_thread_exit _Thrd_detach _Xtime_get_ticks _Mtx_unlock ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBADD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z __crtLCMapStringA ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z _Mtx_lock _Strxfrm ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?id@?$ctype@D@std@@2V0locale@2@A ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z

bcrypt

BCryptGenerateSymmetricKey BCryptSetProperty BCryptEncrypt BCryptCloseAlgorithmProvider BCryptExportKey BCryptGenRandom BCryptOpenAlgorithmProvider BCryptGenerateKeyPair BCryptDecrypt BCryptFinalizeKeyPair BCryptGetProperty BCryptDestroyKey BCryptImportKeyPair

crypt32

CryptStringToBinaryA CryptBinaryToStringA CryptImportPublicKeyInfoEx2 CryptDecodeObjectEx

ws2_32

WSAGetLastError setsockopt ioctlsocket freeaddrinfo htons htonl recv connect accept bind closesocket select listen getaddrinfo WSAStartup send socket

secur32

InitializeSecurityContextW DecryptMessage FreeCredentialsHandle AcquireCredentialsHandleW QueryContextAttributesW DeleteSecurityContext EncryptMessage FreeContextBuffer

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __current_exception_context __current_exception memset memmove memcpy memcmp __C_specific_handler __RTtypeid strchr __std_terminate __std_type_info_compare __std_exception_copy __std_exception_destroy

api-ms-win-crt-stdio-l1-1-0

_fseeki64 fread fsetpos ungetc fputc setvbuf fgetpos fwrite _set_fmode __stdio_common_vsnprintf_s __stdio_common_vfprintf fgetc __stdio_common_vsprintf_s __acrt_iob_func fflush __p__commode _get_stream_buffer_pointers fclose

api-ms-win-crt-heap-l1-1-0

malloc free _callnewh realloc _set_new_mode

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64

api-ms-win-crt-runtime-l1-1-0

__p___argv _errno _beginthreadex _c_exit _register_thread_local_exe_atexit_callback _get_initial_narrow_environment _initterm_e system _set_app_type _seh_filter_exe _cexit _exit terminate _initterm __p___argc abort exit _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit

api-ms-win-crt-string-l1-1-0

tolower strlen

api-ms-win-crt-convert-l1-1-0

strtoull atoi strtol strtoul

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-environment-l1-1-0

_dupenv_s

api-ms-win-crt-locale-l1-1-0

___lc_collate_cp_func ___lc_locale_name_func _configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr