virussign.com_28849c8ed8171b12d72988b1d1c1abb0.vir
Emotet loader, packed, anti-debug
Unsigned DLL claims a system rundll32 entryDetect Emotet loader
SHA-256544c84261adb573c0a7ef7932c42e4b9e548017e36617c833a9675b713bc3731
Evidence
0xff0558bec51894dfc8be55dc20400ccccccU..Q.M...]......
0x1000558bec8b450850e85bf3010083c4045dU...E.P.[......]
0x1010c3cccccccccccccccccccccccccccccc................
0x1020558bec51894dfc8b4dfce85106000050U..Q.M..M..Q...P
0x10308b45fc8b4814518b550852e810000000.E..H.Q.U.R.....
0x104083c40c8be55dc20400cccccccccccccc.....]..........
0x1050558bec83ec088b450883c80f8945fc8bU......E.....E..
0x10604dfc3b4d1076058b4510eb318b550cd1M.;M.v..E..1.U..
0x1070ea8b45102bc239450c76058b4510eb1d..E.+.9E.v..E...
0x10808b4d0cd1e9034d0c894df88d55f8528d.M....M..M..U.R.
0x109045fc50e808f8ffff83c4088b008be55dE.P............]
0x10a0c3cccccccccccccccccccccccccccccc................
0x10b0558bec83ec2c894df08b45088945ec8bU....,.M..E..E..
0x10c04dec8b51108955f48b4dece830010000M..Q..U..M..0...
0x10d08945e88b45f08945f8837df4107306c6.E..E..E..}..s..
0x10e045ff01eb04c645ff008a4dff884dfe0fE.....E...M..M..
0x10f0b655fe85d2742a6a108b45e8508b4df8.U...t*j..E.P.M.
0x110051e88a04000083c40c8b55f88b45f489Q.........U..E..
0x111042108b4df8c741140f000000e9880000B..M..A.........
0x1120008b4df0e8870000008945d48b4df0e8..M.......E..M..
0x11304c0500008945dc8b55f483ca0f8955d8L....E..U.....U.
0x11408d45dc508d4dd851e883f7ffff83c408.E.P.M.Q........
0x11508b108955e08b45e083c001508b4dd4e8...U..E....P.M..
0x11600c0200008945e48d4de4518b55f852e8.....E..M.Q.U.R.
0x11706cf4ffff83c4088b45f483c00150 l.......E....P
0x19248d45f1508b4ddc034dd851e83cfbffff.E.P.M..M.Q.<...
0x193483c4088d4df0e821f4ffffc745fcffff....M..!....E...
0x1944ffff8b45e48b4df464890d000000008b...E..M.d.......
0x1954e55dc21800cccccccccccccc558bec83.]..........U...
0x1964ec0c894dfc8b45fc8b4d0889088b55fc...M..E..M....U.
0x1974c74204000000008b45088945f88b4df8.B......E..E..M.
0x19840fb71181fa4d5a00007402eb338b45f8.....MZ..t..3.E.
0x19948b4df803483c894df48b55f4813a5045.M..H<.M..U..:PE
0x19a400007402eb1a8b45f40fb7481881f90b..t....E...H....
0x19b40100007402eb098b55fc8b45f4894204...t....U..E..B.
0x19c48b45fc8be55dc20400cccccc558bec51.E...]......U..Q
0x19d4894dfc8b45fc8b4804ba080000006bc2.M..E..H......k.
0x19e4008d4401788be55dc3cccccc558bec51..D.x..]....U..Q
0x19f4894dfc8b4dfce8d1ffffff8b4dfc8b11.M..M.......M...
0x1a040310528b45fc8b480483c178518b55fc..R.E..H...xQ.U.
0x1a148b02508b4d0851e81000000083c4108b..P.M.Q.........
0x1a24e55dc20400cccccccccccccc558bec6a.]..........U..j
0x1a34ff68603c031064a10000000050648925.h`<..d.....Pd.%
0x1a440000000081 .....
⋯5 more rows
0x33ff016058100400500001005020017058101....@...........
0x34000130519001b0501181105070019050106................
0x34010150561001d0501601005040018050103..a....`........
0x34020140531001c05013012050d001a05010c..1....0........
0x340301605c100400500001000110012000000....@...........
0x3404008000700090006000a0005000b000400................
0x340500c0003000d0002000e0001000f000000................
0x3406000000000963007772c610eeeba510999.....0.w,a...Q..
0x3407019c46d078ff46a7035a563e9a395649e..m...jp5.c...d.
0x340803288db0ea4b8dc791ee9d5e088d9d2972......y........
0x340902b4cb609bd7cb17e072db8e7911dbf90+L...|.~.-......
0x340a06410b71df220b06a4871b9f3de41be84d.... .jHq...A..
0x340b07dd4da1aebe4dd6d51b5d4f4c785d383}......mQ.......
0x340c056986c13c0a86b647af962fdecc9658aV.l...kdz.b...e.
0x340d04f5c0114d96c0663633d0ffaf50d088dO\...l.cc=......
0x340e0c8206e3b5e10694ce44160d5727167a2. n;^.iL.A`.rqg.
0x340f0d1e4033c47d4044bfd850dd26bb50aa5...<G..K....k...
⋯8 more rows
⋯5 more rows
0x36bb427000000c4770310007803103c780310'....w...x..<x..
0x36bc46100700069002d006d0073002d007700a.p.i.-.m.s.-.w.
0x36bd469006e002d0063006f00720065002d00i.n.-.c.o.r.e.-.
0x36be46600690062006500720073002d006c00f.i.b.e.r.s.-.l.
0x36bf431002d0031002d0031000000610070001.-.1.-.1...a.p.
0x36c0469002d006d0073002d00770069006e00i.-.m.s.-.w.i.n.
0x36c142d0063006f00720065002d0073007900-.c.o.r.e.-.s.y.
0x36c246e00630068002d006c0031002d003200n.c.h.-.l.1.-.2.
0x36c342d003000000000006b00650072006e00-.0.....k.e.r.n.
0x36c4465006c00330032000000000061007000e.l.3.2.....a.p.
0x36c5469002d006d0073002d00000000000000i.-.m.s.-.......
0x36c6402000000466c73416c6c6f6300000000....FlsAlloc....
⋯4 more rows
0x36cb4496e697469616c697a65437269746963InitializeCritic
0x36cc4616c53656374696f6e4578006d007300alSectionEx.m.s.
0x36cd463006f007200650065002e0064006c00c.o.r.e.e...d.l.
0x36ce46c000000436f724578697450726f6365l...CorExitProce
⋯7 more rows
⋯5 more rows
0x375985c85031068850310b0850310c0850310\...h...........
0x375a86100700069002d006d0073002d007700a.p.i.-.m.s.-.w.
0x375b869006e002d0063006f00720065002d00i.n.-.c.o.r.e.-.
0x375c86400610074006500740069006d006500d.a.t.e.t.i.m.e.
0x375d82d006c0031002d0031002d0031000000-.l.1.-.1.-.1...
0x375e86100700069002d006d0073002d007700a.p.i.-.m.s.-.w.
0x375f869006e002d0063006f00720065002d00i.n.-.c.o.r.e.-.
0x37608660069006c0065002d006c0031002d00f.i.l.e.-.l.1.-.
0x3761832002d00320000006100700069002d002.-.2...a.p.i.-.
0x376286d0073002d00770069006e002d006300m.s.-.w.i.n.-.c.
0x376386f00720065002d006c006f0063006100o.r.e.-.l.o.c.a.
0x376486c0069007a006100740069006f006e00l.i.z.a.t.i.o.n.
0x376582d006c0031002d0032002d0031000000-.l.1.-.2.-.1...
0x376686100700069002d006d0073002d007700a.p.i.-.m.s.-.w.
0x3767869006e002d0063006f00720065002d00i.n.-.c.o.r.e.-.
0x376886c006f00630061006c0069007a006100l.o.c.a.l.i.z.a.
0x37698740069006f006e002d006f0062007300t.i.o.n.-.o.b.s.
0x376a86f006c006500740065002d006c003100o.l.e.t.e.-.l.1.
0x376b82d0032002d0030000000000000000000-.2.-.0.........
0x376c86100700069002d006d0073002d007700a.p.i.-.m.s.-.w.
0x376d869006e002d0063006f00720065002d00i.n.-.c.o.r.e.-.
0x376e8700072006f0063006500730073007400p.r.o.c.e.s.s.t.
0x376f86800720065006100640073002d006c00h.r.e.a.d.s.-.l.
0x3770831002d0031002d0032000000610070001.-.1.-.2...a.p.
0x3771869002d006d0073002d00770069006e00i.-.m.s.-.w.i.n.
0x377282d0063006f00720065002d0073007400-.c.o.r.e.-.s.t.
0x37738720069006e0067002d006c0031002d00r.i.n.g.-.l.1.-.
⋯7 more rows