HuaxiaVolcanoInstall
Static task
static1
Behavioral task
behavioral1
Sample
aa6979e0394750a210a00dc7ce1961fcb10280c3bccd64ecbaa20f7e72bc3b7a.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
aa6979e0394750a210a00dc7ce1961fcb10280c3bccd64ecbaa20f7e72bc3b7a.dll
Resource
win10v2004-20230703-en
General
-
Target
aa6979e0394750a210a00dc7ce1961fcb10280c3bccd64ecbaa20f7e72bc3b7a
-
Size
994KB
-
MD5
ce381cd1ce67667a636d7aea2ea57759
-
SHA1
e29240b8193213f43e83ac4d438280f750a600b0
-
SHA256
aa6979e0394750a210a00dc7ce1961fcb10280c3bccd64ecbaa20f7e72bc3b7a
-
SHA512
bb080aeae2fed04500e695e221294c696f1c3db229ce13ec7162a5c3e9df83da3952207be8b31ee12d43650f498a35629e5499ce239c8dc1feccd433e5a2c2f4
-
SSDEEP
24576:kQQc9edo5jHo98vLdAlA7OJACt5xLesSl4v8vYWCB//PeU:kyedoO98DdAzJPresr//P
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aa6979e0394750a210a00dc7ce1961fcb10280c3bccd64ecbaa20f7e72bc3b7a
Files
-
aa6979e0394750a210a00dc7ce1961fcb10280c3bccd64ecbaa20f7e72bc3b7a.dll windows x86
c8e1091cd36ea419818768aa5eb93f14
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
user32
wsprintfA
gdi32
MoveToEx
winmm
midiStreamRestart
winspool.drv
DocumentPropertiesA
advapi32
RegQueryValueA
shell32
Shell_NotifyIconA
ole32
CoTaskMemAlloc
oleaut32
VarDateFromStr
comctl32
ImageList_GetImageInfo
ws2_32
inet_ntoa
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: 979KB - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE