aa7f40ec3346c4e9fd8d9f4dee8a837047b9c8276d7faacd4fed716400965bec | Triage

Sharing

Copy URL Twitter E-mail

General

Target

aa7f40ec3346c4e9fd8d9f4dee8a837047b9c8276d7faacd4fed716400965bec
Size

861KB
MD5

fcd8f08cb95b18bf16df2500da88bba2
SHA1

09630caff7036b413d063d577f9e6cb86ca67e59
SHA256

aa7f40ec3346c4e9fd8d9f4dee8a837047b9c8276d7faacd4fed716400965bec
SHA512

734db4009be7f22bc396e9307c6591e345c985e27539afd7557f291b8a6d34b4d9c2b67402af189ec03d973f8b70cf0b0d28581830ae9b4195d11c050f71eb3d
SSDEEP

12288:ZOSDZLrcVTpxMPNUJ5eFc+0mgLLzDuIjlTqBuQegsYIAEzSJK1YxNIEEOL0WyM0:RDZLMpr5qcSgmIBTqgNyIyJKej0H

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aa7f40ec3346c4e9fd8d9f4dee8a837047b9c8276d7faacd4fed716400965bec

Files

aa7f40ec3346c4e9fd8d9f4dee8a837047b9c8276d7faacd4fed716400965bec
.dll windows:4 windows x86

1c76d65ed943aab0d880ac7c07c83910

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetMenuItemID

gdi32

MoveToEx

winmm

waveOutPause

winspool.drv

ClosePrinter

advapi32

RegQueryValueA

shell32

ShellExecuteA

ole32

CoTaskMemAlloc

oleaut32

VariantCopy

comctl32

ImageList_Draw

ws2_32

closesocket

comdlg32

GetFileTitleA

Exports

Exports

HuaxiaVolcanoInstall

Sections

.text
Size: 835KB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE