08eb06855a14fdf3be60c482a41b762d2287e539de0663a19b687d00bcb6c3fe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

08eb06855a14fdf3be60c482a41b762d2287e539de0663a19b687d00bcb6c3fe
Size

720KB
MD5

391e4e3625d64101192fb41460da0529
SHA1

f701e7c27926989e6d23515c3bddfca08a79eb89
SHA256

08eb06855a14fdf3be60c482a41b762d2287e539de0663a19b687d00bcb6c3fe
SHA512

406dded323065f683f119068f3795e5298c6c001021d59b99aedb42534d0e03f371ceaf227ec24768803d5fd00f80678e32d6d47e5ff78df58db6eb7551b6205
SSDEEP

12288:Bm/KogmHQPv70jiRNElkQFVLYTQbrv3MaO0ToMhyKF+lzwr+cyVUfC3UhrJ7CQVe:EKoev70jib/QFVLtv3wSyKF+wr+TLEj6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
08eb06855a14fdf3be60c482a41b762d2287e539de0663a19b687d00bcb6c3fe

Files

08eb06855a14fdf3be60c482a41b762d2287e539de0663a19b687d00bcb6c3fe
.dll windows:4 windows x86

496c9b38cb0c3ec22f75700161ec8ecf

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

SetParent

gdi32

GetSystemPaletteEntries

winmm

midiStreamRestart

winspool.drv

ClosePrinter

advapi32

RegCloseKey

shell32

ShellExecuteA

ole32

CLSIDFromProgID

oleaut32

SafeArrayGetElement

comctl32

ord17

ws2_32

inet_ntoa

comdlg32

GetSaveFileNameA

Exports

Exports

HuaxiaVolcanoInstall

Sections

.text
Size: 695KB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE