MEmu-setup-abroad-956f11cf[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
MEmu-setup-abroad-956f11cf.exe
Size 131.5MB
Sample260930-ef6ynavgkb
SHA256 956f11cf15d137f1a6ae5b84e40f1fb2d207a917d299b8a201ce6a05ae0acf41
MD5 8fa59200654a3d5132052660c112c1cf
SHA1 e564b03eb36350da3d6da0231ad041af22447fc3
SHA512 3e42b471084c7f2f2c580b850916db99b493671c0a537a871e2d14851a8ddafc10e336ef7440cd47112fc0f354f1054ca0789d10cc71549deb4e08666e80df4a
SSDEEP 3145728:2qu8Q+I+MeooQsFecmasI8xTcawkYb+WsqAJnWJA7PU+:2BEdnsI8Nct4nsWU+
TLSH
T145683343F6C240B5E9721234997BA32A8B75B9158BB0C6D7B3883FDD6A353903937742
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

MEmu-setup-abroad-956f11cf.exe

.exe 131.5MB

MEmu-setup-abroad-956f11cf.exe

IMPHASH 4f6bd8e091797805d84a0178584a9195
SHA256 956f11cf15d137f1a6ae5b84e40f1fb2d207a917d299b8a201ce6a05ae0acf41
MD5 8fa59200654a3d5132052660c112c1cf
SHA1 e564b03eb36350da3d6da0231ad041af22447fc3
SHA512 3e42b471084c7f2f2c580b850916db99b493671c0a537a871e2d14851a8ddafc10e336ef7440cd47112fc0f354f1054ca0789d10cc71549deb4e08666e80df4a
SSDEEP 3145728:2qu8Q+I+MeooQsFecmasI8xTcawkYb+WsqAJnWJA7PU+:2BEdnsI8Nct4nsWU+
TLSH
T145683343F6C240B5E9721234997BA32A8B75B9158BB0C6D7B3883FDD6A353903937742
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Password

123

Digest

3b:3b:7d:26:ce:b0:f6:2e:98:37:ae:92:bf:18:09:ad:8a:74:66:79:1e:ce:f0:4f:58:08:a7:bc:f2:1c:1f:ad

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=9131012030160721XG,CN=Shanghai Microvirt Software Technology Co.\, Ltd.,O=Shanghai Microvirt Software Technology Co.\, Ltd.,ST=上海市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e5a589e8b4a4e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e4b88ae6b5b7e5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Jul 10, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

b4:41:68:91:7f:55:fa:c1:79:86:6e:4f:f0:9b:92:e6:02:6d:8e:de

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

Jul 10, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

Serial Number

0c:13:2c:c0:ed:df:08:4d:0c:09:42:f8:6f:b1:ab:7b

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 5, 2025 - Sep 16, 2027

Minor OS version

Major OS version

Entry point

7504781

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

PeekNamedPipe ReadFileEx CancelIoEx UnmapViewOfFile MapViewOfFile CreateFileMappingW SetEndOfFile GetFileType SetFilePointerEx FlushFileBuffers GetModuleFileNameW GetSystemDirectoryW GetTickCount64 UnregisterWaitEx RegisterWaitForSingleObject FileTimeToSystemTime MoveFileExW CopyFileW GetCurrentDirectoryW GetLongPathNameW GetTempPathW GetFileAttributesW RemoveDirectoryW CreateDirectoryW GetFileAttributesExW GetLogicalDrives TlsGetValue TlsSetValue TlsFree TlsAlloc GetCommandLineW GetSystemTime GetLocalTime CompareStringEx GetDriveTypeW GetDiskFreeSpaceExW GetVolumeInformationW lstrcmpiA lstrlenW FindResourceW LoadResource DeleteFileW LockResource FreeResource WriteFile SizeofResource QueryPerformanceCounter QueryPerformanceFrequency TerminateThread FindCloseChangeNotification FindFirstChangeNotificationW WriteConsoleW HeapQueryInformation SetErrorMode GetFileSizeEx SetEnvironmentVariableW GetOEMCP GetACP IsValidCodePage HeapReAlloc EnumSystemLocalesW IsValidLocale LCMapStringW CompareStringW VirtualProtect GlobalSize FlsSetValue FlsGetValue FlsAlloc SystemTimeToTzSpecificLocalTime SetConsoleCtrlHandler SetFileAttributesW SetStdHandle GetConsoleOutputCP FreeLibraryAndExitThread ExitThread GetCommandLineA LoadLibraryExW RtlUnwind IsDebuggerPresent InitializeSListHead SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx RaiseException ReleaseMutex CreateMutexW VirtualAlloc VirtualFree ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode GetEnvironmentVariableW ConvertThreadToFiber ConvertFiberToThread GetSystemTimeAsFileTime CreateFiber DeleteFiber SwitchToFiber InitializeCriticalSectionAndSpinCount SetHandleInformation GlobalFree GetOverlappedResult LocalAlloc DisconnectNamedPipe ExitProcess GetUserDefaultLangID lstrcmpW DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection SetFileTime SetThreadPriority GetThreadPriority SwitchToThread GetSystemInfo WaitForMultipleObjects SetEvent CreateEventW GetCurrentThread DuplicateHandle GetEnvironmentStringsW ExpandEnvironmentStringsW GlobalUnlock GlobalLock GlobalAlloc CheckRemoteDebuggerPresent WTSGetActiveConsoleSessionId GetModuleHandleExW FindFirstFileExW FindNextFileW GetGeoInfoW GetUserGeoID GetTimeZoneInformation GetUserPreferredUILanguages GetLocaleInfoW GetTimeFormatW GetDateFormatW GetCurrencyFormatW GetUserDefaultLCID WriteFileEx FlsFree SleepEx GetFileInformationByHandleEx GetFileInformationByHandle GetFullPathNameW FindClose FindFirstFileW GetVolumePathNamesForVolumeNameW DeviceIoControl SystemTimeToFileTime TzSpecificLocalTimeToSystemTime FormatMessageW OutputDebugStringW ResetEvent WaitForSingleObjectEx GetConsoleWindow SetFilePointer GetStdHandle Sleep ConnectNamedPipe CreateNamedPipeW HeapSize FreeEnvironmentStringsW FindNextChangeNotification GetTickCount SetCurrentDirectoryW IsProcessorFeaturePresent GetExitCodeProcess OpenThread MoveFileW WaitNamedPipeW WideCharToMultiByte FreeLibrary GetModuleHandleW CreateProcessW GetProcessHeap GetCurrentProcessId LocalFree GetProcAddress HeapAlloc LoadLibraryW CloseHandle Process32FirstW LoadLibraryA Process32NextW GetLastError MultiByteToWideChar CreateToolhelp32Snapshot OpenProcess GetModuleHandleA ResumeThread CreateFileW WaitForSingleObject Thread32First CreatePipe Thread32Next GetUserDefaultUILanguage K32GetModuleFileNameExW TerminateProcess GetCurrentProcess SetLastError HeapFree ReadFile GetStartupInfoW CreateThread GetCurrentThreadId

user32

SetWindowLongW CreateWindowExW UnregisterClassW RegisterClassW CallNextHookEx SetTimer DefWindowProcW GetQueueStatus PeekMessageW KillTimer DestroyWindow MessageBoxW PostThreadMessageW EnumWindows GetWindowLongW GetWindowRect SetWindowPos GetWindowThreadProcessId SetWindowsHookExW MsgWaitForMultipleObjectsEx TranslateMessage DispatchMessageW UnhookWindowsHookEx CharNextExA SystemParametersInfoW GetDC EnableMenuItem GetSysColor GetSystemMetrics UpdateLayeredWindowIndirect GetCaretBlinkTime GetDoubleClickTime IsWindow MessageBeep EndPaint BeginPaint IsIconic GetAncestor InvalidateRect SetForegroundWindow ReleaseCapture GetParent UpdateLayeredWindow GetClientRect DrawIconEx RegisterDeviceNotificationW UnregisterDeviceNotification GetUserObjectInformationW PostMessageW GetProcessWindowStation ChangeWindowMessageFilterEx RealGetWindowClassW GetWindowTextW CloseTouchInputHandle GetTouchInputInfo GetMessageExtraInfo GetAsyncKeyState TrackMouseEvent GetIconInfo GetCursor GetCursorInfo CreateIconIndirect CreateCursor LoadCursorW SetCursorPos GetClipboardFormatNameW EnumDisplayDevicesW FlashWindowEx SetCursor SetCapture SetParent GetUpdateRect SetFocus GetShellWindow GetDesktopWindow ReleaseDC GetSystemMenu SetLayeredWindowAttributes UnregisterTouchWindow RegisterClipboardFormatW GetMenuItemInfoW ModifyMenuW CreatePopupMenu TrackPopupMenu SetMenu DestroyMenu DrawMenuBar InsertMenuW RemoveMenu AppendMenuW CreateMenu LoadIconW GetKeyState MapVirtualKeyW GetKeyboardState SetMenuItemInfoW ToUnicode TrackPopupMenuEx IsZoomed ToAscii MonitorFromWindow EnumDisplayMonitors GetMonitorInfoW HideCaret SetCaretPos CreateCaret GetKeyboardLayout IsWindowEnabled DestroyCaret ShowCaret RegisterWindowMessageW FindWindowA SetClipboardViewer IsHungAppWindow ChangeClipboardChain GetFocus ChildWindowFromPointEx RegisterClassExW WindowFromPoint GetClassInfoW GetKeyboardLayoutList UnregisterPowerSettingNotification RegisterPowerSettingNotification GetSysColorBrush LoadImageW GetCursorPos AdjustWindowRectEx IsTouchWindow MonitorFromPoint GetWindow GetMenu IsWindowVisible SetWindowRgn ScreenToClient SendMessageW SetWindowTextW GetWindowPlacement DestroyCursor ShowWindow GetCapture DestroyIcon RegisterTouchWindow ClientToScreen IsChild SetWindowPlacement AttachThreadInput GetForegroundWindow MoveWindow

shell32

SHChangeNotify SHGetFileInfoW SHGetStockIconInfo SHCreateItemFromParsingName SHGetMalloc SHBrowseForFolderW SHGetKnownFolderIDList SHGetPathFromIDListW CommandLineToArgvW ShellExecuteW ord727 SHCreateItemFromIDList Shell_NotifyIconW Shell_NotifyIconGetRect

ole32

StringFromGUID2 RegisterDragDrop CoLockObjectExternal RevokeDragDrop OleUninitialize OleInitialize CoCreateGuid OleIsCurrentClipboard OleGetClipboard CoInitializeEx DoDragDrop ReleaseStgMedium CoGetMalloc CoTaskMemFree CoCreateInstance CoUninitialize OleSetClipboard CoInitialize OleFlushClipboard

advapi32

CryptAcquireContextW RegFlushKey RegEnumKeyExW GetEffectiveRightsFromAclW AccessCheck MapGenericMask LookupAccountSidW GetNamedSecurityInfoW DuplicateToken BuildTrusteeWithSidW CopySid GetLengthSid RegQueryValueExA RegDeleteKeyW RegCreateKeyExW RegSetValueExW RegQueryInfoKeyA RegOpenKeyExA RegEnumValueW CreateServiceW RegDeleteValueW CloseServiceHandle OpenSCManagerW GetSidSubAuthorityCount AllocateAndInitializeSid GetSidSubAuthority SetEntriesInAclW SetNamedSecurityInfoW ChangeServiceConfigA OpenProcessToken FreeSid StartServiceW CheckTokenMembership DuplicateTokenEx QueryServiceStatusEx OpenServiceA GetTokenInformation RegQueryValueExW RegEnumKeyW RegQueryInfoKeyW RegCloseKey RegOpenKeyExW InitializeSecurityDescriptor InitializeAcl AddAccessAllowedAce SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl RegNotifyChangeKeyValue DeregisterEventSource RegisterEventSourceW ReportEventW SystemFunction036 CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptCreateHash CryptDestroyHash CryptSignHashW CryptEnumProvidersW

ws2_32

WSACleanup WSAStartup gethostname WSAAsyncSelect htonl getsockopt getnameinfo getaddrinfo ntohl freeaddrinfo WSAIoctl setsockopt htons WSANtohs WSANtohl WSAGetLastError WSASocketW getsockname WSAConnect bind listen WSAAccept WSARecvFrom WSARecv WSAHtonl WSASendTo WSASend select __WSAFDIsSet closesocket recv send WSASetLastError getpeername

gdi32

CombineRgn DeleteObject SelectClipRgn CreateRectRgn OffsetRgn SetLayout SetPixelFormat GetPixelFormat SwapBuffers ChoosePixelFormat DescribePixelFormat CreateBitmap DeleteDC CreateDCW CreateCompatibleDC SelectObject CreateCompatibleBitmap GetObjectW GetBitmapBits GetDeviceCaps BitBlt GetRegionData GdiFlush CreateDIBSection CreateFontIndirectW GetFontData EnumFontFamiliesExW AddFontMemResourceEx RemoveFontMemResourceEx GetTextMetricsW AddFontResourceExW RemoveFontResourceExW GetStockObject GetTextFaceW GetOutlineTextMetricsW GetTextExtentPoint32W SetGraphicsMode SetWorldTransform GetGlyphOutlineW GetCharABCWidthsFloatW GetCharABCWidthsI GetCharABCWidthsW SetTextColor SetBkMode SetTextAlign ExtTextOutW GetDIBits

oleaut32

SafeArrayCreateVector SysFreeString SysAllocString SafeArrayPutElement

imm32

ImmAssociateContextEx ImmSetCandidateWindow ImmGetOpenStatus ImmAssociateContext ImmGetCompositionStringW ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmGetDefaultIMEWnd ImmGetVirtualKey ImmNotifyIME

winmm

timeKillEvent PlaySoundW timeSetEvent

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

uxtheme

GetThemeBool ord47 GetThemePropertyOrigin GetThemeTransitionDuration GetThemeEnumValue GetCurrentThemeName GetThemeMargins GetThemeInt OpenThemeData GetThemeColor CloseThemeData GetThemePartSize IsThemeActive IsThemeBackgroundPartiallyTransparent GetThemeBackgroundRegion SetWindowTheme IsAppThemed

dwmapi

DwmIsCompositionEnabled DwmEnableBlurBehindWindow DwmSetWindowAttribute DwmGetWindowAttribute

iphlpapi

ConvertInterfaceNameToLuidW ConvertInterfaceIndexToLuid ConvertInterfaceLuidToGuid ConvertInterfaceLuidToIndex ConvertInterfaceLuidToNameW GetAdaptersAddresses GetAdaptersInfo

crypt32

CertCloseStore CertOpenSystemStoreW CertFindCertificateInStore CertCreateCertificateContext CertGetCertificateChain CertFreeCertificateChain CertFreeCertificateContext CertOpenStore CertAddCertificateContextToStore CertGetCertificateContextProperty CertEnumCertificatesInStore CertDuplicateCertificateContext

userenv

GetUserProfileDirectoryW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

netapi32

NetShareEnum NetApiBufferFree

bcrypt

BCryptGenRandom

Name

.text

Size

7.5MB

Virtual Size

7.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

10.6MB

Virtual Size

10.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

337KB

Virtual Size

404KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.qtmetad

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.qtmimed

Size

315KB

Virtual Size

315KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

112.5MB

Virtual Size

112.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

298KB

Virtual Size

297KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

MEmu-setup-abroad-956f11cf.exe

kernel32

user32

shell32

ole32

advapi32

ws2_32

gdi32

oleaut32

imm32

winmm

wtsapi32

uxtheme

dwmapi

iphlpapi

crypt32

userenv

version

netapi32

bcrypt

generic