Null Emu[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Null Emu.exe
Size 16.2MB
Sample260908-vftw4avemd
SHA256 427611d08c01c2a45e217bd30ee3c001dcb406480d0b3e6c1d85a9644367226f
MD5 a63b66b2e68e993f064acf6d29c48516
SHA1 e84038c14783d7e0b42362dbd04ed5a1422a8163
SHA512 bec549985cd95be3f32fe3035ab20b53020655e337296a2fa53b2be2f1a9fdaa7d11b512fb596e2fc8e4d86a6ae4291ba41e8675ee511d03f3f2f8ba3cb8ee46
SSDEEP 196608:8lbcZ+q7WbwphrFzOvihyYsDdTGtz/Zu8pRZ7tRI/NCtFNUBEjIU0Hdu3hy1KP3T:6bcZpWbGBqYsUtzRftRuNCnaBUxvyRa
TLSH
T1960723C27EEEC2ACD1DB4F2025C2539E39C972E581FD8A5E35C95C022A41D2A4CDE677
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Null Emu.exe

File Explorer

Null Emu.exe

.exe 16.2MB

Null Emu.exe

IMPHASH 8a0d2e07924cd2260d4c3146409d625c
SHA256 427611d08c01c2a45e217bd30ee3c001dcb406480d0b3e6c1d85a9644367226f
MD5 a63b66b2e68e993f064acf6d29c48516
SHA1 e84038c14783d7e0b42362dbd04ed5a1422a8163
SHA512 bec549985cd95be3f32fe3035ab20b53020655e337296a2fa53b2be2f1a9fdaa7d11b512fb596e2fc8e4d86a6ae4291ba41e8675ee511d03f3f2f8ba3cb8ee46
SSDEEP 196608:8lbcZ+q7WbwphrFzOvihyYsDdTGtz/Zu8pRZ7tRI/NCtFNUBEjIU0Hdu3hy1KP3T:6bcZpWbGBqYsUtzRftRuNCnaBUxvyRa
TLSH
T1960723C27EEEC2ACD1DB4F2025C2539E39C972E581FD8A5E35C95C022A41D2A4CDE677
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14412229

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegOpenKeyExA

kernel32

Thread32First GetSystemTimeAsFileTime HeapAlloc HeapFree ExitProcess LoadLibraryA GetModuleHandleA GetProcAddress

user32

GetAsyncKeyState

gdi32

StretchBlt

shell32

SHGetFolderPathA

ole32

CreateStreamOnHGlobal

msvcp140

?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z

winhttp

WinHttpOpen

crypt32

CertGetCertificateChain

normaliz

IdnToAscii

wldap32

ord45

ws2_32

gethostname

wininet

InternetOpenA

shlwapi

PathFindFileNameW

bcrypt

BCryptGenerateSymmetricKey

gdiplus

GdipCreateBitmapFromHBITMAP

ntdll

VerSetConditionMask

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context

api-ms-win-crt-heap-l1-1-0

calloc

api-ms-win-crt-utility-l1-1-0

srand

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-string-l1-1-0

strncpy

api-ms-win-crt-convert-l1-1-0

strtod

api-ms-win-crt-stdio-l1-1-0

_fseeki64

api-ms-win-crt-filesystem-l1-1-0

_fstat64

api-ms-win-crt-environment-l1-1-0

_dupenv_s

api-ms-win-crt-math-l1-1-0

_dclass

api-ms-win-crt-locale-l1-1-0

___lc_collate_cp_func

psapi

GetModuleInformation

Name

.text

Size

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

896KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

228KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.f}V

Size

Virtual Size

9.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.B)w

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.Eqe

Size

16.2MB

Virtual Size

16.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

296B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Null Emu.exe

advapi32

kernel32

user32

gdi32

shell32

ole32

msvcp140

winhttp

crypt32

normaliz

wldap32

ws2_32

wininet

shlwapi

bcrypt

gdiplus

ntdll

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

psapi

generic