emulator (1)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
emulator (1).exe
Size 5.7MB
Sample261022-thdgfsssax
SHA256 8f43dfebef728a508cf937abc22780d5033182d193a41014b92eecfcf8f447f6
MD5 386e849fce83bb83a2d6782af0f09422
SHA1 d6026b2757b1808e0e3f30d99c2a5d70543bcbfc
SHA512 30aa50a41e0a214fc8c7bd29708281c09318ae38819e53a058916bf369165c22f4cbcd0c8e7f96e5fe08f77897fa79dd9babc9705e7ee3f2130bbb21fa5fdcd3
SSDEEP 98304:G6IA9NSIhxC0PO8F/bK5YxzlTx4Kc5hqsAJkY3z6T6:LI2SIhxZPO8F/bK5Yz
TLSH
T106564A4365DB0CE9CED7A7B861C7A336A334FD718A296F2B9644C6302D537C16E1AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
emulator (1).exe

File Explorer

emulator (1).exe

.exe 5.7MB

emulator (1).exe

IMPHASH 57db90971c402d9ee4d4913510c33a9c
SHA256 8f43dfebef728a508cf937abc22780d5033182d193a41014b92eecfcf8f447f6
MD5 386e849fce83bb83a2d6782af0f09422
SHA1 d6026b2757b1808e0e3f30d99c2a5d70543bcbfc
SHA512 30aa50a41e0a214fc8c7bd29708281c09318ae38819e53a058916bf369165c22f4cbcd0c8e7f96e5fe08f77897fa79dd9babc9705e7ee3f2130bbb21fa5fdcd3
SSDEEP 98304:G6IA9NSIhxC0PO8F/bK5YxzlTx4Kc5hqsAJkY3z6T6:LI2SIhxZPO8F/bK5Yz
TLSH
T106564A4365DB0CE9CED7A7B861C7A336A334FD718A296F2B9644C6302D537C16E1AB10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

15:02:e2:22:88:ba:a2:35:37:c4:d5:c5:33:c8:ef:3e:ee:75:80:6f:69:eb:53:0e:b8:92:de:75:08:d6:2b:2c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=WTSvc

Chains

Oct 15, 2026

CN=WTSvc

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AllocateAndInitializeSid CheckTokenMembership CloseServiceHandle CreateServiceW FreeSid GetUserNameA GetUserNameW OpenSCManagerW OpenServiceW RegCloseKey RegOpenKeyExW RegSetValueExW StartServiceW

bcrypt

BCryptCloseAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptSetProperty

crypt32

CryptUnprotectData

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject GetDIBits SelectObject SetStretchBltMode StretchBlt

iphlpapi

GetAdaptersInfo

kernel32

AreFileApisANSI CloseHandle CopyFileW CreateDirectoryW CreateEventA CreateFileA CreateFileMappingW CreateFileW CreateHardLinkW CreateMutexW CreateProcessW CreateSemaphoreA CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection FindResourceW FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW FreeLibrary GetCPInfo GetCommandLineW GetComputerNameA GetComputerNameW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceA GetDiskFreeSpaceExW GetDiskFreeSpaceW GetDriveTypeW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileSize GetFileSizeEx GetFileType GetFullPathNameA GetFullPathNameW GetLastError GetLogicalDrives GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessAffinityMask GetProcessHeap GetStartupInfoA GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTempPathA GetTempPathW GetThreadContext GetThreadPriority GetTickCount GetTickCount64 GetVersionExA HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate InitializeCriticalSection IsDBCSLeadByte LeaveCriticalSection LoadLibraryA LoadLibraryW LoadResource LocalFree LockFile LockFileEx LockResource MapViewOfFile MoveFileExW MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW Process32First Process32FirstW Process32Next Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseSemaphore RemoveDirectoryW ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEvent SetFileAttributesW SetFilePointer SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SizeofResource Sleep SuspendThread SystemTimeToFileTime TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnlockFile UnlockFileEx UnmapViewOfFile VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteFile

msvcrt

iswctype fwprintf _assert __C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _beginthreadex _cexit _close _commode _endthreadex _errno _findclose _fmode _fstat64 _get_osfhandle _initterm _localtime64 _lseeki64 _pclose _popen _setjmp _setmode _telli64 _vscprintf _vsnprintf _wchdir _wchmod _wcsicmp _wfopen _wfullpath _wgetcwd _wmkdir _wopen _wstat64 _wtoi _wutime64 abort atexit calloc exit fclose fflush fgets fopen fprintf fputc fputwc free getenv isalnum localeconv longjmp malloc memchr memcmp memcpy memmove memset realloc setlocale setvbuf signal strchr strcmp strcoll strcspn strerror strftime strlen strncmp strrchr strspn strtoul strxfrm tolower towlower towupper vfprintf wcscat wcscmp wcscoll wcscpy wcsftime wcslen wcsxfrm _wfindnext _wfindfirst _lseeki64 _write _strdup _read _fileno _fdopen

ole32

CoCreateInstance CoInitializeEx CoUninitialize

shell32

SHCreateDirectoryExW SHGetFolderPathW ShellExecuteExW

user32

CallNextHookEx DispatchMessageA GetAsyncKeyState GetDC GetMessageA GetSystemMetrics ReleaseDC SetWindowsHookExA TranslateMessage

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

228KB

Virtual Size

228KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

70KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

102KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1022KB

Virtual Size

1022KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

1024B

Virtual Size

744B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

512B

Virtual Size

151B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

512B

Virtual Size

468B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

emulator (1).exe

PE Signature issue

advapi32

bcrypt

crypt32

gdi32

iphlpapi

kernel32

msvcrt

ole32

shell32

user32

winhttp

generic