Emulator[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Emulator.exe
Size 63.6MB
Sample260925-pznarssvfs
SHA256 563785a841a920406ffcdb06a33d40d375e656c1a7f44548cf8bc60b6782bc60
MD5 93a95f1d72f6eec9b755ef3bcc6eec22
SHA1 a6dceb2177adf28ca5cd8cae801f0fceca58c644
SHA512 616a12ab05d50b76ae8f1d232c58ed51b711a09ac96edc143f8e00811d5d274c53f9a726f31fcf0eff9c04a033a8812b13e5f914620902aab2a6539a1d643acc
SSDEEP 786432:3kxMieiAT/wmAjyFe0q7Vry6zwH1Q0KYm+wHDwB:3kxMieiALwmAjyFe0q7VrbO8HD
TLSH
T111E7724C24500AE8925BE815EAA7CF1B5FE9D6DB5BE8244DBCA88E344CD3CB71D1074B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Emulator.exe

File Explorer

Emulator.exe

.exe 63.6MB

Emulator.exe

IMPHASH 61c917d6fb469a821b6641bafe96c11e
SHA256 563785a841a920406ffcdb06a33d40d375e656c1a7f44548cf8bc60b6782bc60
MD5 93a95f1d72f6eec9b755ef3bcc6eec22
SHA1 a6dceb2177adf28ca5cd8cae801f0fceca58c644
SHA512 616a12ab05d50b76ae8f1d232c58ed51b711a09ac96edc143f8e00811d5d274c53f9a726f31fcf0eff9c04a033a8812b13e5f914620902aab2a6539a1d643acc
SSDEEP 786432:3kxMieiAT/wmAjyFe0q7Vry6zwH1Q0KYm+wHDwB:3kxMieiALwmAjyFe0q7VrbO8HD
TLSH
T111E7724C24500AE8925BE815EAA7CF1B5FE9D6DB5BE8244DBCA88E344CD3CB71D1074B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

55773872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrator\Desktop\vgc emulator5\vgc emulator\x64\Release\vanguard emulator.pdb

kernel32

CancelIoEx HeapAlloc GetLocalTime Beep ExitProcess ReadProcessMemory GetProcessHeap SystemTimeToFileTime GetSystemTimeAsFileTime SetConsoleCursorPosition IsDebuggerPresent ConnectNamedPipe VirtualQueryEx CheckRemoteDebuggerPresent FlushFileBuffers Process32FirstW Process32NextW GetLastError Sleep CreateToolhelp32Snapshot OpenProcess DisconnectNamedPipe GetEnvironmentVariableA CreateNamedPipeW WriteFile WriteConsoleA GetStdHandle GetCurrentProcess SetConsoleTitleA SetConsoleTextAttribute HeapFree GetConsoleScreenBufferInfo SetConsoleCtrlHandler FillConsoleOutputCharacterA GetModuleFileNameA OutputDebugStringW InitializeSListHead GetCurrentProcessId QueryPerformanceCounter GetSystemInfo WakeAllConditionVariable UnmapViewOfFile MapViewOfFile CreateFileMappingA GetFileSize VirtualProtect VirtualQuery VirtualFree VirtualAlloc RemoveVectoredExceptionHandler GetThreadContext GetTickCount VirtualAllocEx SetFilePointer CreateFileA GetSystemDirectoryA VirtualFreeEx GetModuleHandleW IsWow64Process GetProcAddress GetModuleHandleA DuplicateHandle HeapSize HeapReAlloc HeapDestroy RaiseException LoadLibraryA AddVectoredExceptionHandler K32GetModuleInformation LocalFree DecodePointer DeleteCriticalSection InitializeCriticalSectionEx GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive SetUnhandledExceptionFilter CloseHandle ReadFile

user32

MessageBoxA FindWindowA UnregisterClassA

advapi32

GetTokenInformation ConvertSidToStringSidA OpenThreadToken CopySid GetLengthSid LookupPrivilegeValueW SetSecurityDescriptorDacl AdjustTokenPrivileges CryptAcquireContextW CryptGenRandom CryptCreateHash CryptHashData CryptDestroyHash OpenProcessToken InitializeSecurityDescriptor CryptGetHashParam CryptReleaseContext IsValidSid LookupAccountSidA

msvcp140

??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBADD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z __crtLCMapStringA ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z _Mtx_trylock _Strxfrm _Query_perf_frequency ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z _Mtx_unlock _Xtime_get_ticks _Thrd_detach _Query_perf_counter _Cnd_do_broadcast_at_thread_exit _Strcoll _Mtx_lock ?id@?$collate@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Xbad_alloc@std@@YAXXZ ?uncaught_exception@std@@YA_NXZ

winhttp

WinHttpQueryDataAvailable WinHttpOpen WinHttpAddRequestHeaders WinHttpReceiveResponse WinHttpReadData WinHttpConnect WinHttpSendRequest WinHttpOpenRequest WinHttpCloseHandle WinHttpSetTimeouts WinHttpQueryHeaders

bcrypt

BCryptSetProperty BCryptGetProperty BCryptDecrypt BCryptOpenAlgorithmProvider BCryptEncrypt BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptDestroyKey

crypt32

CryptStringToBinaryA CryptBinaryToStringA

shlwapi

ord215

userenv

UnloadUserProfile

ntdll

NtMapViewOfSection NtClose NtCreateSection RtlImageNtHeader NtUnmapViewOfSection

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler __std_exception_destroy __std_exception_copy memmove memcmp __std_type_info_compare _CxxThrowException __current_exception __current_exception_context __std_terminate memcpy __RTtypeid strchr memset

api-ms-win-crt-stdio-l1-1-0

_set_fmode __stdio_common_vswprintf_s __stdio_common_vsprintf _get_stream_buffer_pointers _fseeki64 __stdio_common_vsscanf fread __p__commode ungetc setvbuf fgetpos fwrite fgetc __stdio_common_vsprintf_s fclose fputc fsetpos fflush

api-ms-win-crt-heap-l1-1-0

realloc calloc malloc _set_new_mode free _callnewh _recalloc

api-ms-win-crt-string-l1-1-0

_wcsicmp wcscmp towlower isalnum strcat strcpy strncmp strnlen tolower wcsncpy_s strlen wcslen

api-ms-win-crt-runtime-l1-1-0

exit _crt_atexit __p___argc __p___argv _initterm_e _register_thread_local_exe_atexit_callback _initterm _invoke_watson _register_onexit_function _get_initial_narrow_environment _set_app_type _initialize_onexit_table _resetstkoflw _seh_filter_exe _c_exit _configure_narrow_argv _beginthreadex _errno _invalid_parameter_noinfo _exit terminate system _initialize_narrow_environment _cexit

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-locale-l1-1-0

___lc_collate_cp_func _configthreadlocale ___lc_locale_name_func

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-utility-l1-1-0

rand srand

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-math-l1-1-0

__setusermatherr