Behavioral task
behavioral1
Sample
EhPG小说下载器V2.5/EhPG小说下载.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
EhPG小说下载器V2.5/EhPG小说下载.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral3
Sample
EhPG小说下载器V2.5/微软语音库/启动与停止语音库服务程序.exe
Resource
win7-20231023-en
Behavioral task
behavioral4
Sample
EhPG小说下载器V2.5/微软语音库/启动与停止语音库服务程序.exe
Resource
win10v2004-20231020-en
General
-
Target
f07c0ceafa91b1295922ce9ddc4e89f240930885021688a69d1a6924f38c4a4a
-
Size
1.1MB
-
MD5
5c99d6d80e13eda3d10be176df780b32
-
SHA1
449936a45be878f398f12e1cc6cbf52e0a855460
-
SHA256
f07c0ceafa91b1295922ce9ddc4e89f240930885021688a69d1a6924f38c4a4a
-
SHA512
32fecbcaf02bb06a2e264e453eb09b8cfb6af299392669269aad099723241dec978f9bbd6117ff8c44b127724c3fd198f3482e1a427e6ea8fd76e0a6d2e88aa5
-
SSDEEP
24576:FfA9WB9yc71EQW336BJmzQRow6gR0khtlQieNpbTr5F6xX:+6ycxs6GERSgKkuLbH5A
Malware Config
Signatures
-
resource yara_rule static1/unpack001/EhPG小说下载器V2.5/EhPG小说下载.exe upx static1/unpack001/EhPG小说下载器V2.5/微软语音库/启动与停止语音库服务程序.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/EhPG小说下载器V2.5/EhPG小说下载.exe unpack001/EhPG小说下载器V2.5/微软语音库/启动与停止语音库服务程序.exe
Files
-
f07c0ceafa91b1295922ce9ddc4e89f240930885021688a69d1a6924f38c4a4a.zip
-
EhPG小说下载器V2.5/EhPG小说下载.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 729KB - Virtual size: 732KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 47KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
EhPG小说下载器V2.5/使用说明【使用前必看】.txt
-
EhPG小说下载器V2.5/微软语音库/0.reg
-
EhPG小说下载器V2.5/微软语音库/1.txt
-
EhPG小说下载器V2.5/微软语音库/使用说明.txt
-
EhPG小说下载器V2.5/微软语音库/启动与停止语音库服务程序.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 728KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 309KB - Virtual size: 312KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 95KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE