115ad50e4966c4d10eaa018d33feb38e1a942da084a62ea17448cf681d9dff51 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

115ad50e4966c4d10eaa018d33feb38e1a942da084a62ea17448cf681d9dff51
Size

702KB
MD5

c4975942c75b5c543823d04b48c39805
SHA1

cbff39b9d47e63dbae471be7a5460c99ef46ff79
SHA256

115ad50e4966c4d10eaa018d33feb38e1a942da084a62ea17448cf681d9dff51
SHA512

3c601a450ee9073edbee799f2a8326d2e6af85a2796161a86e13a4f2bd1bd45a1e0b8159ef3f9660931dbd2d5dd1fc701d6d171b1aa8a43ee6edddcbc721a42c
SSDEEP

12288:ekCtL+ltgJ1EdN2v6m2kQ0xhJCFa421mxM98j5lw/Lo1kmBaphwjfe1mOC0VARDl:hCtL+WyadKChYFa11CMGoTo1kuapiab

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
115ad50e4966c4d10eaa018d33feb38e1a942da084a62ea17448cf681d9dff51

Files

115ad50e4966c4d10eaa018d33feb38e1a942da084a62ea17448cf681d9dff51
.dll windows x86

da11d508fec06e7bdf0c398e2ba3e2bd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

rasapi32

RasHangUpA

user32

SetClipboardData

gdi32

OffsetViewportOrgEx

winmm

waveOutRestart

winspool.drv

DocumentPropertiesA

advapi32

RegCloseKey

shell32

Shell_NotifyIconA

ole32

CLSIDFromProgID

oleaut32

VariantCopy

comctl32

ImageList_Read

ws2_32

WSACleanup

wininet

InternetCloseHandle

comdlg32

GetFileTitleA

Exports

Exports

HuaxiaVolcanoInstall

Sections

.text
Size: 677KB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE