emulator.zip
- SHA256 38ab90caf5203bf7d8985eaa506f27e842af0a5a99e3bdafa6110539c04c7fab
Static task
static1
1 signatures
General
- Target emulator.zip
- Size 44.6MB
- Sample260930-3yy8jayand
- SHA256 38ab90caf5203bf7d8985eaa506f27e842af0a5a99e3bdafa6110539c04c7fab
- MD5 be10536945817ce4642cc76ceac2ce8d
- SHA1 0c3f5f2599d563404d905a2a3ef457522502739b
- SHA512 0b0d81f5d13a5a26e88bae24f168c01e198ef5c8cc290124d0300b7d70cd33dfed68cc9727d677fa63db876915a88278a4d72c918815057a8517dad4a1903229
- SSDEEP 786432:fV9O/lJRhSjxjNlEG7gAk7GrW3R8MDV/Vg8XH1Mgwyv9cRizROhxRrZFCsiQ4:rg/GVN+XOW3R28XH1M9gcctOhTHtu
- TLSH T187A733FC0B6D56AE0D4BCF22DB3D74563A2E6446608B3584BE5091138B272C6DE1DEB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/emulator/package/RobloxPlayerBeta.dll
File Explorer
-
emulator.zip.zip 44.6MB
-
emulator/emulator.sln798B
-
emulator/emulator.vcxproj.xml 4KB
-
emulator/install.md801B
-
emulator/package/RobloxPlayerBeta.bin100.8MB
-
emulator/package/RobloxPlayerBeta.dll.dll 177KB
-
emulator/src/emulator.cpp25KB
-
emulator/src/emulator.def43B
-
emulator/src/offsets.h48KB
-
emulator/version.txt73B
emulator/emulator.sln
- SHA256 1c4643a943f69326536f38b2e7b10e555ee6636a32ad00fa2ac8f994b478092c
- MD5 19b6b958190a37697fb6830f50a53946
- SHA1 975b61170c8f808b1ef3a2afd97374bd6fe82a1e
- SHA512 19401de4b19db211e53139e0b9b4cebd350469ff36fde9f46d649504d6f59a23fb1d23b46995381f6330cfc086e62550fb2d2684a2caa7ff8fb01a6d696e1935
- TLSH T14901D66C953F78919482135FE0810C9B3BB2036892495D7E9CA7A06D362BF46431B69F
- MD5 SHA1 SHA512 TLSH
emulator/emulator.vcxproj
- SHA256 443b8f36c0f28bbafe163372fef0f98559b6cc79dc31541a9978c4fdf02fdcfe
- MD5 4e40004d4ba593bf806576da1ce91113
- SHA1 5928b596fd2b069e0d68f9b22a127790d2e82e8c
- SHA512 3339ebebe3d741fde85f1a3cee5359369aaf103df59e96878b75c7bd0015a5a4af00b9932b2a325e19382b17aa677e79355d0f1e97a3f77965dd1c82927997f3
- SSDEEP 96:CQebfqU1AUkhZ4tw/zTnPcCMxHg/zTFPcaMxo1:Fed1fk//3PcpA/1Pcxo
- TLSH T173A11F94D4F41B67E0A34227E2E66C45AFB2D3830C5B4C1CF69EA6486F5B5086217F73
- MD5 SHA1 SHA512 SSDEEP TLSH
emulator/install.md
- SHA256 eacfa7249131a0ebb6ce51c595ace24633bfd38c5786d5da93db4bc398dce0ea
- MD5 fe9808c0dc1fc4190a04d79d8415ebe5
- SHA1 13be278b967358fd326ac1d1ef0d3c78860695c8
- SHA512 bbaea9536b97febf0ace180d968c370028a85e64fdc1d8067924d7e64cb7834bce318b7e5960b6d4f485cb575d948a9bd2183fa59c9dc8c99b70ffcd24fc12f1
- TLSH T1D901ABB782E8322954574256E608C5B1FB6351C6117F74AAE4ACF24D766052803FDAC0
- MD5 SHA1 SHA512 TLSH
emulator/package/RobloxPlayerBeta.bin
- SHA256 c582679e7170f4fad8b9c683dc0005adadcc0ddad912f8c20201a93c1c42c912
- MD5 4748742dba5c7da1fe3d6a0efa1d9593
- SHA1 b3910816e234de88838ae808da70a6356ad48bab
- SHA512 263eeaeac5ae80a5f45019e2c59764448b4fca94af3db08dd3c443d007fa69f10a44f0e104e969286154f3aa7ef43dc0d9d407608f464d23a7d2ec19bc2805e9
- SSDEEP 786432:hpAvd5UIIVawU2Q7Zk+oKpc09MFltCM3of:DAPUIEa/LVtoqT9MAMa
- TLSH T14C388D5A60ED50E8D5BEE078DB1AE917F7B13409033056E702E48A6A2F73EF05A7E711
- MD5 SHA1 SHA512 SSDEEP TLSH
emulator/package/RobloxPlayerBeta.dll
- IMPHASH af984a113e6079eeb1ef29fe9a1ca4df
- SHA256 00ad98f2016696e542322e41e3c24e0d426137f263503b14ee9ea2eb0f0194a9
- MD5 cd9e108d235a64b8cad73794de26dadc
- SHA1 d4835cd491b7bde6bbd8877a7d312f0b8b331335
- SHA512 fdcaf14496d81d58370a4cb8a2ff6822bee355c2e03e60f12ceb9d3991c57353baa5738dc6b6d7c9e4253f6772d69a658c217dbd121447b0fcffcd6c9ce67694
- SSDEEP 3072:0tgpFr6hQg3SIL6zjk8jx/OXxJWzyQr0GWSVG7kW3yfh9pY8terxQGMLZ:0tqFr6hQlnk8cBJtGm7kk89urXMt
- TLSH T1B704295BB39448ABECE6C57DC5935602E7B2B42E07109BFF0294E56AAE0F3D44D3D620
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
18176
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
bcrypt
BCryptGetProperty
BCryptCreateHash
BCryptHashData
BCryptDestroyHash
BCryptFinishHash
BCryptGenRandom
BCryptOpenAlgorithmProvider
api-ms-win-core-file-l1-1-0
FindFirstFileExW
ReadFile
FindNextFileW
SetFilePointerEx
CreateFileW
WriteFile
GetFileSizeEx
FindClose
GetFileType
FlushFileBuffers
api-ms-win-core-memory-l1-1-0
VirtualAlloc
VirtualFree
VirtualProtect
api-ms-win-core-processthreads-l1-1-0
GetStartupInfoW
GetCurrentProcess
TerminateProcess
ExitProcess
GetCurrentProcessId
CreateThread
GetCurrentThreadId
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
GetModuleHandleA
FreeLibrary
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetModuleHandleExW
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlAddFunctionTable
RtlUnwindEx
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
GetProcessMitigationPolicy
IsProcessorFeaturePresent
FlushInstructionCache
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
LoadLibraryA
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetSystemInfo
api-ms-win-core-errorhandling-l1-1-1
AddVectoredExceptionHandler
api-ms-win-core-memory-l1-1-3
SetProcessValidCallTargets
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
GetLastError
api-ms-win-core-interlocked-l1-1-0
InterlockedFlushSList
InitializeSListHead
api-ms-win-core-fibers-l1-1-0
FlsFree
FlsSetValue
FlsAlloc
FlsGetValue
api-ms-win-core-util-l1-1-0
EncodePointer
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
HeapSize
HeapReAlloc
GetProcessHeap
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-localization-l1-2-0
IsValidCodePage
GetOEMCP
GetCPInfo
GetACP
LCMapStringW
api-ms-win-core-processenvironment-l1-1-0
SetStdHandle
GetCommandLineA
GetCommandLineW
FreeEnvironmentStringsW
GetStdHandle
GetEnvironmentStringsW
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte
api-ms-win-core-console-l1-1-0
WriteConsoleW
GetConsoleMode
GetConsoleOutputCP
run
Name
.text
Size
76KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
85KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=137, id=261, version=35222,
count=12, id=260, version=35222,
count=8, id=259, version=35222,
count=9, id=259, version=35721,
count=15, id=260, version=35721,
count=35, id=261, version=35721,
count=54, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=35222,
count=110, id=1, productName=Unmarked objects,
count=1, id=265, version=36260,
count=1, id=256, version=36260,
count=1, id=255, version=36260,
count=1, id=258, version=36260,
emulator/src/emulator.cpp
- SHA256 f5975b90418051f305e1584e19fd64175d4d48f08dd081119afed648a8fdc578
- MD5 f0a8738a19c09672858540274ce136ba
- SHA1 c70a87433bc0d4646e7d6bdf4158c33e46eafcad
- SHA512 554897eb87b968dd6c4b0f1dc744ebb15a5132eafbd6cb12109760368920e15838bcf846822137cf634b1cc4966bf1b28ab9150198591899752385f8044216f7
- SSDEEP 384:BvR3Z28fQTcISyvSjt6lOnaTEZURXZW20d+t+oow5iVYQsan:BRY8VKOnaXZWeow5X8
- TLSH T1B4C283C918FBF43921235179868B8422B219C81372EECF56FA5FC1A07F951B5C5F4D8A
- MD5 SHA1 SHA512 SSDEEP TLSH
emulator/src/emulator.def
- SHA256 22a32de23dfdf5a7a30a50411294904562b6b52fa0eff284583479293cee655c
- MD5 2ab96a52524c609bd0e30e7120830fac
- SHA1 60a26973a36e053296af6572f8e59f47940a7c89
- SHA512 59986cc72697bb65a6a7475f63a52a5d8653d33f295bce4fe74c4bf54ca88fd97f75e5b6d0021029b989a68aedef045f2158d19ea914b3ab961df065cbe08101
- MD5 SHA1 SHA512
emulator/src/offsets.h
- SHA256 4b23c2abadbef9a1e1f9b8cfbf6f3122a341eee4b8b882bd469b858c60533282
- MD5 1d60a36c704aaadd73d199b445f384b0
- SHA1 4de117d1dddbf62044f35bed32cc4459ead614de
- SHA512 f290d7c7df86568a03c73f08e51a3ded522191b131a50b1e2bec52c2a87ea54f3f1c62e5c3af06e7799c6859879d9c8b5dfff8e2cae6b0f6b58a3c4b1c113dec
- SSDEEP 1536:vGAnKhVzeIoQ6EnZP9DLXSmwc+lT+9Wu5HzFB:vGAnKhViIoQ6EnZFDT9bg+9J5HzFB
- TLSH T14A23AE2CD5BF5DEB224A8190D6468CDC703F31A298B527292FE4834B2F7E05D61BB197
- MD5 SHA1 SHA512 SSDEEP TLSH
emulator/version.txt
- SHA256 0f6acc4f8825f0cf9e26f86c5d77e0470a7a3933047eefbba8ef34e99662db10
- MD5 9dabee3946a20203396646cb9eafcb62
- SHA1 671a7b4425dc2a11aff6079774dd6ea19b91777b
- SHA512 f695f3416382af9a3620477f0ddd51375a85052236f85e3642962405e82bd7b63a6101e38d2adc1b9f79d01beb0ae0a7f94357ca73e9472abffdd0383bf48d34
- TLSH T147A022A00033FC2F0030230ECC0280E8F3F80AA882CB3800B3C3030C232200A030A02C
- MD5 SHA1 SHA512 TLSH