EMULight[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
EMULight.dll
Size 1.2MB
Sample261006-tbd5eazz9m
SHA256 8266f5c39715b48e04fe484b709e0d110b33bdb0141a5af90cb6928a16d04b97
MD5 72a5e8e987e850a822540c10743b37b2
SHA1 cacd563a0d56d1418569df6a2b7f700fdbf7946d
SHA512 424cdaad56aa6e8ac2c581dda1aef7b0e59ba09a0fae57becb0484c8c43049a4685f41a3fa67869acb6828254b36f04be9e0a8d611db492100f790eb9f80beeb
SSDEEP 24576:OLM15uGzMZ3obURGbSVR+4TQTyBDqt6v+8MSJRBwymVi2Knvo9xLBFHRA:ifGzMZ3o+GbSVR+4cTyB+t6XP2KnR
TLSH
T19345AF9171E941B8D0BBD178D987DE1BE672340803345ADB13F699582FB37F0A27BA12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
EMULight.dll

File Explorer

EMULight.dll

.dll 1.2MB

EMULight.dll

IMPHASH 1bc3fe81c6fa2fb2cb3214e15e736534
SHA256 8266f5c39715b48e04fe484b709e0d110b33bdb0141a5af90cb6928a16d04b97
MD5 72a5e8e987e850a822540c10743b37b2
SHA1 cacd563a0d56d1418569df6a2b7f700fdbf7946d
SHA512 424cdaad56aa6e8ac2c581dda1aef7b0e59ba09a0fae57becb0484c8c43049a4685f41a3fa67869acb6828254b36f04be9e0a8d611db492100f790eb9f80beeb
SSDEEP 24576:OLM15uGzMZ3obURGbSVR+4TQTyBDqt6v+8MSJRBwymVi2Knvo9xLBFHRA:ifGzMZ3o+GbSVR+4cTyB+t6XP2KnR
TLSH
T19345AF9171E941B8D0BBD178D987DE1BE672340803345ADB13F699582FB37F0A27BA12
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

944000

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\ege\Desktop\nvidiaprofiles\prosocceronlineue5profiles\profilesue5\bin\Release\PSO_ModMenu.pdb

d3d11

D3D11CreateDeviceAndSwapChain

dxgi

CreateDXGIFactory1

kernel32

GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte GetProcAddress FreeLibrary QueryPerformanceCounter VirtualFree VirtualAlloc GetSystemInfo VirtualQuery HeapCreate VirtualProtect HeapFree GetCurrentProcess Thread32Next Thread32First SuspendThread ResumeThread CreateToolhelp32Snapshot HeapReAlloc HeapAlloc HeapDestroy GetThreadContext GetCurrentProcessId GetModuleHandleW FlushInstructionCache SetThreadContext OpenThread InitializeSListHead SleepConditionVariableSRW CreateEventW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileInformationByHandleEx AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose GetLocaleInfoEx FormatMessageA GetModuleHandleA WaitForSingleObject CloseHandle GetTickCount64 GetCurrentThreadId SetLastError WideCharToMultiByte OutputDebugStringA CreateThread DisableThreadLibraryCalls Sleep FreeLibraryAndExitThread GetSystemTimeAsFileTime LocalFree GetLastError MultiByteToWideChar WakeAllConditionVariable GetEnvironmentVariableW

user32

GetCapture ScreenToClient ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW GetMessageExtraInfo SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData DestroyWindow DefWindowProcA CreateWindowExA UnregisterClassA RegisterClassExA DefWindowProcW GetKeyState MapVirtualKeyA GetKeyNameTextA CallWindowProcW SetWindowLongPtrW

advapi32

RegGetValueW RegOpenKeyExW RegCloseKey RegCreateKeyExW RegSetValueExW RegDeleteValueW

shell32

ShellExecuteW SHGetKnownFolderPath

ole32

CoTaskMemFree

msvcp140

?_Xlength_error@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA _Mtx_lock _Xtime_get_ticks _Mtx_unlock ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Xbad_alloc@std@@YAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ _Query_perf_frequency ?_Xinvalid_argument@std@@YAXPEBD@Z _Query_perf_counter ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

crypt32

CryptProtectData CryptUnprotectData

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate memcmp __std_exception_destroy __std_exception_copy memcpy strchr memmove memset __std_type_info_destroy_list _CxxThrowException __current_exception_context __current_exception __C_specific_handler memchr

api-ms-win-crt-heap-l1-1-0

_callnewh free malloc

api-ms-win-crt-time-l1-1-0

strftime _time64 _localtime64_s

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf fseek __stdio_common_vsprintf ftell fputc __stdio_common_vswprintf_s __acrt_iob_func _wfopen fflush _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos fwrite fgetc fclose __stdio_common_vsscanf

api-ms-win-crt-string-l1-1-0

strlen strncmp strncpy tolower strncpy_s strcmp wcslen isxdigit

api-ms-win-crt-math-l1-1-0

log atan2f fmodf roundf sin sinf sqrt _dsign sqrtf acosf ceilf pow powf cosf cos logf

api-ms-win-crt-convert-l1-1-0

atof strtod strtoul

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func localeconv

api-ms-win-crt-runtime-l1-1-0

abort _initterm_e _seh_filter_dll _initterm terminate _cexit _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _errno

api-ms-win-crt-utility-l1-1-0

rand qsort