HuaxiaVolcanoInstall
Behavioral task
behavioral1
Sample
90f7f3058b8d4d662905932ed25e3679fb18f1ff5635c81fd6066d6dfc4cd3f7.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
90f7f3058b8d4d662905932ed25e3679fb18f1ff5635c81fd6066d6dfc4cd3f7.dll
Resource
win10v2004-20230703-en
General
-
Target
90f7f3058b8d4d662905932ed25e3679fb18f1ff5635c81fd6066d6dfc4cd3f7
-
Size
846KB
-
MD5
fd964b7c8d8df9ed2d339888b553dc24
-
SHA1
6c2166ca425cacec2d2d972dedd489cbcafbeb1c
-
SHA256
90f7f3058b8d4d662905932ed25e3679fb18f1ff5635c81fd6066d6dfc4cd3f7
-
SHA512
9b3ac05990be140e5f49b81b3c91a99c33b25b6d4a9a81be22421a7020deb51fcc529e11395329bbe376cfeec417e3d3d0c4c43657d91ed91855f9e2c4d0940b
-
SSDEEP
24576:CU2w62UKPR1y9BGzc5XcX/ywT/++1nv113m:CU2wPy9Bqc5MXawT++11
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 90f7f3058b8d4d662905932ed25e3679fb18f1ff5635c81fd6066d6dfc4cd3f7
Files
-
90f7f3058b8d4d662905932ed25e3679fb18f1ff5635c81fd6066d6dfc4cd3f7.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
UPX0 Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 824KB - Virtual size: 828KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE