9c7c91876ddc24eee68516645c1a389371d6c5de3acbc708bed3ef094375ffb0 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9c7c91876ddc24eee68516645c1a389371d6c5de3acbc708bed3ef094375ffb0
Size

1.6MB
MD5

2081bf969cf06a9a43e80ee4d8de9051
SHA1

0d6e50b335b7b3338f3d7a91e9ea2c34336c5d5a
SHA256

9c7c91876ddc24eee68516645c1a389371d6c5de3acbc708bed3ef094375ffb0
SHA512

bf1bccb846cc162caefefa88d96f3a78edb01f8b1b5c543d1ca2b5cba7010f0144eb9b3bb80ba2a6805014cf199c52f1d0b57075428b2678330e0dbf15235b7a
SSDEEP

49152:5QDRzMwG0Gw4Sely3opzlGqP0IBoW4r4pJKBbZYe8n9naPCR:u1MwG0Gw4Sk5zcqP0Om8pJ7e89aPk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9c7c91876ddc24eee68516645c1a389371d6c5de3acbc708bed3ef094375ffb0

Files

9c7c91876ddc24eee68516645c1a389371d6c5de3acbc708bed3ef094375ffb0
.dll windows x86

561e1469448aba827fec692e0581d7f0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

rasapi32

RasHangUpA

user32

CloseClipboard

gdi32

SetStretchBltMode

winmm

midiStreamRestart

winspool.drv

DocumentPropertiesA

advapi32

RegQueryValueA

shell32

ShellExecuteA

ole32

RevokeDragDrop

oleaut32

VarDateFromStr

comctl32

ImageList_GetImageInfo

ws2_32

recv

wininet

InternetCloseHandle

comdlg32

GetFileTitleA

Exports

Exports

HuaxiaVolcanoInstall

Sections

.text
Size: 1.6MB - Virtual size: 5.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE