HuaxiaVolcanoInstall
Behavioral task
behavioral1
Sample
1e1976ed52055ef2c196f121b6b8be13a4f6daf1d6e19bf41c6dbef88d41ff47.dll
Resource
win7-20230824-en
Behavioral task
behavioral2
Sample
1e1976ed52055ef2c196f121b6b8be13a4f6daf1d6e19bf41c6dbef88d41ff47.dll
Resource
win10v2004-20230703-en
General
-
Target
1e1976ed52055ef2c196f121b6b8be13a4f6daf1d6e19bf41c6dbef88d41ff47
-
Size
742KB
-
MD5
2057acd3025997cde16db37192656073
-
SHA1
b2bec93653c76a7b9e85327138143ae4ed246326
-
SHA256
1e1976ed52055ef2c196f121b6b8be13a4f6daf1d6e19bf41c6dbef88d41ff47
-
SHA512
134957ff7ebe54bb4ba4a681cb93edc2b1ba706afa71b9ab2bfdea4be67530be7b615ba4158f57c03d172432f707b0063d9b1e5e68ef89ad1a887f522f60e882
-
SSDEEP
12288:juiRdFPx1eB9uYV8Yh7gA7HwAdYOUnBuqHA1g51rgiWahhEHY8loS:KQFZ6bVfN6Eqg181scXV8
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1e1976ed52055ef2c196f121b6b8be13a4f6daf1d6e19bf41c6dbef88d41ff47
Files
-
1e1976ed52055ef2c196f121b6b8be13a4f6daf1d6e19bf41c6dbef88d41ff47.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
UPX0 Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 733KB - Virtual size: 736KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE