Static task
static1
Behavioral task
behavioral1
Sample
ebmf08/qmebmf08.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
ebmf08/qmebmf08.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
ebmf08/新云软件.url
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
ebmf08/新云软件.url
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
ebmf08/秦码二笔输入法帮助.chm
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
ebmf08/秦码二笔输入法帮助.chm
Resource
win10v2004-20231215-en
General
-
Target
5804e1ead844f94a3e71095377b3029e
-
Size
10.3MB
-
MD5
5804e1ead844f94a3e71095377b3029e
-
SHA1
a1a8cc99525a680033c2f449f5f543c243bd4bce
-
SHA256
c1ef10785e264966cdcb120b23350055dc3cecb9d9e1d037c2f986df0cb3e0b4
-
SHA512
02b96ad238a793a5066bb9bbb0ce8c7a99de41e1cf9626d56d07fe6df9d2913868d05bfc162b3a18e1ba14d8a3a05dc023c9bc8b7ed318a645217071e2a1fe03
-
SSDEEP
196608:6BIZJHOlO0kjAZWm0/LuuGV4JmTY4w4qQAjLiV4FHj1GAsU4T4C0fIi10nfUhZk3:6GJHgdkjAF04V41quG4FDQNtT4Cvi10h
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ebmf08/qmebmf08.exe
Files
-
5804e1ead844f94a3e71095377b3029e.rar
-
ebmf08/qmebmf08.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 73KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_stext Size: 40KB - Virtual size: 36KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_data Size: 4KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_rsrc Size: 85KB - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
ebmf08/新云软件.url.url
-
ebmf08/秦码二笔输入法帮助.chm.chm
-
ebmf08/自述文件.txt