4c01c0989aaf59b41b61c24a13ba9033002f3331b2781c3284be1c4688044e2a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4c01c0989aaf59b41b61c24a13ba9033002f3331b2781c3284be1c4688044e2a
Size

1.1MB
MD5

602897e19abf014132851b224886befa
SHA1

1670a46768e7f0a7def2e058fda6dfe594067840
SHA256

4c01c0989aaf59b41b61c24a13ba9033002f3331b2781c3284be1c4688044e2a
SHA512

6a518865af54bcb0e3964d210b20cfb9d660a6ac044fed332c4f6c06a7fbf29c3c4b5434e7fe0730a4a7838758a79d3c1e0a36a7ead67b52aca78c47d627b7f4
SSDEEP

24576:b+6SFudoIEOnnud4qE0wON1gIkJgsn4aX6+5k+q:qFjOnud4IxsD12+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4c01c0989aaf59b41b61c24a13ba9033002f3331b2781c3284be1c4688044e2a

Files

4c01c0989aaf59b41b61c24a13ba9033002f3331b2781c3284be1c4688044e2a
.dll windows:4 windows x86

c8e1091cd36ea419818768aa5eb93f14

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

wsprintfA

gdi32

MoveToEx

winmm

midiStreamRestart

winspool.drv

DocumentPropertiesA

advapi32

RegQueryValueA

shell32

Shell_NotifyIconA

ole32

CoTaskMemAlloc

oleaut32

VarDateFromStr

comctl32

ImageList_GetImageInfo

ws2_32

inet_ntoa

comdlg32

GetFileTitleA

Exports

Exports

HuaxiaVolcanoInstall

Sections

.text
Size: 1.0MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE