ShadowEmu[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ShadowEmu.exe
Size 945KB
Sample260816-t7wpbsem7v
SHA256 c349f5b5aa1ea92e5c3ec4306651e974fad286e2f11a53fb6e2adbb51d071e40
MD5 2fbe45345a0fd5df62791b95b0c56431
SHA1 8fc09ea49d2b84719e1a5ad42a034d326d19c6e4
SHA512 30dbe9e62ee9561212a53657938022711934cf683048ce3f4aeba0c3cb2fabab97b4dff3c8f49a5eed1f91ceed432f2645cddd669edf73f86a5dca62ed94e054
SSDEEP 12288:EzWf/bDxMC0EQhe6ri1GR9Uy6rXGkQ+YD8iLH9xmSVRz:n/bFP0E87ri1GL8XGLZtLHX
TLSH
T11C257D2A5E5402FDE0A7C179CEA69D42E771B80A03B19EEF07D045623F676E05F3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ShadowEmu.exe

File Explorer

ShadowEmu.exe

.exe 945KB

ShadowEmu.exe

IMPHASH 710255184f22509ed2e5f2763d5e5bfa
SHA256 c349f5b5aa1ea92e5c3ec4306651e974fad286e2f11a53fb6e2adbb51d071e40
MD5 2fbe45345a0fd5df62791b95b0c56431
SHA1 8fc09ea49d2b84719e1a5ad42a034d326d19c6e4
SHA512 30dbe9e62ee9561212a53657938022711934cf683048ce3f4aeba0c3cb2fabab97b4dff3c8f49a5eed1f91ceed432f2645cddd669edf73f86a5dca62ed94e054
SSDEEP 12288:EzWf/bDxMC0EQhe6ri1GR9Uy6rXGkQ+YD8iLH9xmSVRz:n/bFP0E87ri1GL8XGLZtLHX
TLSH
T11C257D2A5E5402FDE0A7C179CEA69D42E771B80A03B19EEF07D045623F676E05F3A712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

466272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpSetOption WinHttpReceiveResponse WinHttpOpen WinHttpAddRequestHeaders WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect WinHttpQueryDataAvailable

advapi32

ConvertSidToStringSidW RegEnumValueW RegQueryValueExW GetTokenInformation LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey CredReadW CredEnumerateW CredFree RegEnumKeyExW RegOpenKeyExW GetUserNameW CheckTokenMembership FreeSid AllocateAndInitializeSid ConvertStringSecurityDescriptorToSecurityDescriptorW OpenProcessToken

user32

GetWindowLongPtrW GetWindowLongW GetWindowThreadProcessId GetWindowTextLengthW GetWindow IsWindowVisible IsWindow GetAsyncKeyState GetClassNameW GetWindowTextW EnumWindows GetForegroundWindow SetWindowLongPtrW

kernel32

SetEndOfFile FreeLibraryAndExitThread GetModuleHandleExW GetConsoleCP GetCommandLineA GetCommandLineW HeapAlloc ExitThread CreateThread LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlPcToFileHeader GetModuleFileNameA SizeofResource GetFileSizeEx SetConsoleTextAttribute SetConsoleScreenBufferSize GetStdHandle WriteFile SetConsoleMode SetConsoleWindowInfo GetConsoleScreenBufferInfoEx MultiByteToWideChar Sleep GetConsoleMode SetConsoleScreenBufferInfoEx CreateFileA LoadLibraryA LockResource CloseHandle LoadResource FindResourceW SetFileAttributesA GetProcAddress SetConsoleCP GetConsoleWindow SetConsoleOutputCP CreateDirectoryA SetConsoleTitleW ReadFile MoveFileA GetCurrentProcess HeapFree WriteConsoleOutputCharacterA CreateNamedPipeW SetSystemTime CreateMutexA WaitForSingleObject CreateFileW ReleaseMutex DisconnectNamedPipe OpenProcess CreateToolhelp32Snapshot GetTickCount64 GetLastError GetFileAttributesA Process32NextW DeleteFileA Process32FirstW GetSystemInfo CancelIoEx CreateFileMappingA LocalFree ExitProcess ReadProcessMemory WideCharToMultiByte CreateProcessA ConnectNamedPipe VirtualQueryEx FlushFileBuffers GetModuleFileNameW DeleteFileW GetEnvironmentVariableA GetComputerNameW GetModuleHandleW QueryFullProcessImageNameW FindFirstFileA FindNextFileA FindClose GetCurrentThread GetTickCount IsDebuggerPresent CheckRemoteDebuggerPresent SetFilePointerEx RtlUnwindEx InitializeSListHead GetCurrentProcessId GetStartupInfoW IsProcessorFeaturePresent WriteConsoleW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW HeapReAlloc GetConsoleOutputCP GetTimeZoneInformation GetFileAttributesExW CreateProcessW GetExitCodeProcess GetFileType SetUnhandledExceptionFilter ReadConsoleW PeekConsoleInputA ReadConsoleInputW FlsAlloc FlsGetValue FlsSetValue TerminateProcess RtlUnwind UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW GetNumberOfConsoleInputEvents EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect GetCurrentThreadId QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx WakeAllConditionVariable GetSystemTimeAsFileTime CompareStringEx GetCPInfo FlsFree

shell32

ShellExecuteA SHGetFolderPathA ShellExecuteW

winmm

waveOutOpen mciSendStringW waveOutClose waveOutUnprepareHeader waveOutWrite waveOutPrepareHeader

bcrypt

BCryptExportKey BCryptGenRandom BCryptOpenAlgorithmProvider BCryptGenerateKeyPair BCryptDecrypt BCryptFinalizeKeyPair BCryptGetProperty BCryptDestroyKey BCryptEncrypt BCryptFinishHash BCryptDestroyHash BCryptImportKeyPair BCryptHashData BCryptCreateHash BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptSetProperty

crypt32

CryptDecodeObjectEx CryptStringToBinaryA CryptBinaryToStringA CryptImportPublicKeyInfoEx2

secur32

GetUserNameExA

netapi32

NetApiBufferFree NetUserGetInfo

wininet

InternetReadFile InternetConnectA HttpSendRequestA InternetCloseHandle InternetOpenA HttpAddRequestHeadersA InternetSetOptionA HttpOpenRequestA InternetQueryOptionA HttpQueryInfoA

Name

.text

Size

671KB

Virtual Size

670KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

169KB

Virtual Size

169KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

66KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ShadowEmu.exe

winhttp

advapi32

user32

kernel32

shell32

winmm

bcrypt

crypt32

secur32

netapi32

wininet

generic