» emu.exe
Overview
Analysis
File Details
Downloads (29)

emu.exe

The executable emu.exe has been detected as malware by 5 anti-virus scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer, however the file is not signed with an authenticode signature from a trusted source. The file has been seen being downloaded from b4af1w.bl3302.livefilestore.com and multiple other hosts.

File name:

emu.exe

MD5:

61baf03aff12f15f2c65cfa9cca95974

SHA-1:

2d3e6f7045c196a0401a9ceec81af6acbdb3ce97

SHA-256:

021ffc9811ab2e2c676dfb17b51cfdfc0a69272da6a3aa1ae8bd3c5b47766bee

Scanner detections:

5 / 68

Status:

Malware

Analysis date:

4/25/2024 6:04:58 PM UTC (today)

Scan engine

Detection

Engine version

Baidu Antivirus

Trojan.MSIL.Agent

4.0.3.14911

Comodo Security

UnclassifiedMalware

19471

Kaspersky

HEUR:Trojan.Win32.Generic

14.0.0.3266

McAfee

Artemis!61BAF03AFF12

5600.7010

Qihoo 360 Security

Win32/Trojan.e6d

1.0.0.1015

File size:

2.1 MB (2,198,938 bytes)

File type:

Executable application (Win32 EXE)

Installer:

NSIS (Nullsoft Scriptable Install System)

Common path:

C:\users\{user}\downloads\emu.exe

File PE Metadata

Compilation timestamp:

12/25/2013 6:01:41 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

49152:02eSCSoMcexYdkMGCXCxMlHVmc3cdnisRkrwfXsjFdX7E:UStoZoYG6CYn3cdNog6dXQ

Entry address:

0x30E4

Entry point:

81, EC, 84, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 90, 91, 40, 00, 89, 5C, 24, 20, C6, 44, 24, 14, 20, FF, 15, 34, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, 1C, 71, 40, 00, 53, FF, 15, 8C, 72, 40, 00, 6A, 08, A3, 58, E4, 42, 00, E8, 95, 2D, 00, 00, A3, A4, E3, 42, 00, 53, 8D, 44, 24, 38, 68, 60, 01, 00, 00, 50, 53, 68, E0, 87, 42, 00, FF, 15, 64, 71, 40, 00, 68, 80, 91, 40, 00, 68, A0, DB, 42, 00, E8, 3F, 2A, 00, 00, FF, 15, 20, 71, 40, 00, BD, 00, 40, 43, 00, 50, 55, E8, 2D, 2A... 
[+]

Packer / compiler:

Nullsoft install system v2.x

Code size:

23.5 KB (24,064 bytes)

The file emu.exe has been seen being distributed by the following 29 URLs.

https://b4af1w.bl3302.livefilestore.com/.../emu.exe

https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=12&ct=1417014068&rver=6.4.6456.0&wp=MBI_SSL_SHARED&wreply=https://.../download?resid=558C6B79B515B952!106&lc=1033&id=250206&cbcxt=sky

https://doc-14-bk-docs.googleusercontent.com/docs/securesc/j2mkpm9co3aaakppefgsmve4ctskajs3/kc0j6v0b3gdpdkhba4014mg7jdtp7ni3/1419199200000/02389099468332117340/.../0BwElGBuh7RFGSThBN1NVV3FHa00?e=download&nonce=60eemqogu54f2&user=06695665368421239566&hash=o4hkbl4tccubndporfeput3vmftdesbs

https://docs.google.com/nonceSigner?nonce=60eemqogu54f2&continue=https://doc-14-bk-docs.googleusercontent.com/docs/securesc/j2mkpm9co3aaakppefgsmve4ctskajs3/kc0j6v0b3gdpdkhba4014mg7jdtp7ni3/1419199200000/02389099468332117340/06695665368421239566/0BwElGBuh7RFGSThBN1NVV3FHa00?e=download&hash=hmisq0hubs4octapihh6nk0ur6judi69&urp=http://.../download.html&auth=DQAAANcAAACnQLRkEDf4Ea5OVbi4JOS1K4DaQukjap7p6-zY4zzGThVdVKgN_eQw8rvGnM4krll2N03uPt9MpTQNcXZXcDN69cYPdJlLeP-Mvb622ZVAJG13pxAShbzRv1CANgR2TTOIb7DyJ2pnSK4YPRw2OfzhkpKevwBRshJDjILnD-REkdt7XmsusU1J6cPt9AAkM_3JTQumcbHej91CFCFezLrTq7xy-ca_HhdiZDOVocWtaPvrP1F0lLtdZHOCtiZ_apmF6uZCT7b1Msg2ZddPV1JjMFZ9H0FOWq1kLwSFgVTXxg&authuser=0

https://accounts.youtube.com/accounts/SetSID?ssdc=1&sidt=ALWU2cseImRozuOjXv6Y9ivMUALVNsFkYdeb iJzDTAtaApTOXGqKOefZQOIAsTqqj/hBVYVrGJBjYDwIhr8MT9ewno/Nh1l2xNan/qXwTqcQ5M6SpPK2dw BYE5hKi/j/doKlQ5FT4KITYfTAzd8il3b8Ki0niBBpT9IDtCeHQ1kTXT3PDzCReXTZHSHPygqEzRC/MXKALv77Yj17BWp9PmU6t76sMLoPVImK/Z2nn8pj1UvYW1h0e0eM83bXEwLc9/q6OcvoHkegvbiDQMBZt2xoJFLg600DSHpbLF52kg2Uu36GgJ7bJ0VEj0Pzf2X/w3JR5F/Ni233lzLf3BEH3gEePrIlwWtYW7Bk/vvIbepQGrCq/VWcx2U884RLbgWENEmx8LdpfUAi/y2 F5AgCJkie0r50Lmz6d7cyASye7NVQ0BWDvuKnl7SKUp4MUdfJoWMVOyXMtjclex4QOb//3lSF8c5vrXT4/vqsWDxjqD uo189YcKgexl8iQKTJzooJyWZH8uWWzFM3rOGNd5q 2Fkkb 45vA==&continue=https://docs.google.com/nonceSigner?nonce=60eemqogu54f2&continue=https://doc-14-bk-docs.googleusercontent.com/docs/securesc/j2mkpm9co3aaakppefgsmve4ctskajs3/kc0j6v0b3gdpdkhba4014mg7jdtp7ni3/1419199200000/02389099468332117340/.../0BwElGBuh7RFGSThBN1NVV3FHa00%

https://accounts.google.com/ServiceLogin?service=writely&passive=1209600&continue=https://docs.google.com/nonceSigner?nonce=60eemqogu54f2&continue=https://doc-14-bk-docs.googleusercontent.com/docs/securesc/j2mkpm9co3aaakppefgsmve4ctskajs3/kc0j6v0b3gdpdkhba4014mg7jdtp7ni3/1419199200000/02389099468332117340/06695665368421239566/0BwElGBuh7RFGSThBN1NVV3FHa00?e=download&hash=hmisq0hubs4octapihh6nk0ur6judi69&urp=http://.../download.html&followup=https://docs.google.com/nonceSigner?nonce=60eemqogu54f2&continue=https://doc-14-bk-docs.googleusercontent.com/docs/securesc/j2mkpm9co3aaakppefgsmve4ctskajs3/kc0j6v0b3gdpdkhba4014mg7jdtp7ni3/1419199200000/02389099468332117340/06695665368421239566/0BwElGBuh7RFGSThBN1NVV3FHa00?e=download&hash=hmisq0hubs4octapihh6nk0ur6judi69&urp=http://.../download.html&ltmpl=homepage&emr=1&authuser=0

https://www.google.com/accounts/ServiceLogin?service=writely&passive=1209600&continue=https://docs.google.com/nonceSigner?nonce=60eemqogu54f2&continue=https://doc-14-bk-docs.googleusercontent.com/docs/securesc/j2mkpm9co3aaakppefgsmve4ctskajs3/kc0j6v0b3gdpdkhba4014mg7jdtp7ni3/1419199200000/02389099468332117340/06695665368421239566/0BwElGBuh7RFGSThBN1NVV3FHa00?e=download&hash=hmisq0hubs4octapihh6nk0ur6judi69&urp=http://.../download.html&followup=https://docs.google.com/nonceSigner?nonce=60eemqogu54f2&continue=https://doc-14-bk-docs.googleusercontent.com/docs/securesc/j2mkpm9co3aaakppefgsmve4ctskajs3/kc0j6v0b3gdpdkhba4014mg7jdtp7ni3/1419199200000/02389099468332117340/06695665368421239566/0BwElGBuh7RFGSThBN1NVV3FHa00?e=download&hash=hmisq0hubs4octapihh6nk0ur6judi69&urp=http://.../download.html&ltmpl=homepage&emr=1&authuser=0

https://b4af1w.bl3302.livefilestore.com/.../emu.exe

https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=12&ct=1413996091&rver=6.4.6456.0&wp=MBI_SSL_SHARED&wreply=https://.../download?resid=558C6B79B515B952!106&lc=1033&id=250206&cbcxt=sky

https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=12&ct=1414303149&rver=6.4.6456.0&wp=MBI_SSL_SHARED&wreply=https://.../download?resid=558C6B79B515B952!106&lc=1033&id=250206&cbcxt=sky

https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=12&ct=1417014068&rver=6.4.6456.0&wp=MBI_SSL_SHARED&wreply=https://.../download?resid=558C6B79B515B952!106&lc=1033&id=250206&cbcxt=sky

https://drive.google.com/uc?export=download&confirm=&id=0BwElGBuh7RFGSThBN1NVV3FHa00

https://b4af1w.bl3302.livefilestore.com/.../emu.exe

https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=12&ct=1411747023&rver=6.4.6456.0&wp=MBI_SSL_SHARED&wreply=https://.../download?resid=558C6B79B515B952!106&lc=1033&id=250206&cbcxt=sky

https://b4af1w.bl3302.livefilestore.com/.../emu.exe

https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=12&ct=1416654826&rver=6.4.6456.0&wp=MBI_SSL_SHARED&wreply=https://.../download?resid=558C6B79B515B952!106&lc=1033&id=250206&cbcxt=sky

https://onedrive.live.com/download?resid=558C6B79B515B952!106

Remove emu.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.