850dfafac2700fbcfda5a7f54fafe2637da103d3bfc2438137bb079ebf03cca8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

850dfafac2700fbcfda5a7f54fafe2637da103d3bfc2438137bb079ebf03cca8
Size

848KB
MD5

dec396ed12961acdaa5b3e7a576f6282
SHA1

681d6fa095501fe1dc8bf5584cd6e0ae0afa658d
SHA256

850dfafac2700fbcfda5a7f54fafe2637da103d3bfc2438137bb079ebf03cca8
SHA512

9ac78b006994611a67083dd3ab0ecf993a88afcd6480b2a92916cf768153014a941a858d7320da5b61903d859d353cca52c20839a6a6a4bbb849e2863759c305
SSDEEP

24576:rxI3r/s+6skp8HU/nNSJ4sIlDPpNeAZRg:rxI3jsxySDBNeAj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
850dfafac2700fbcfda5a7f54fafe2637da103d3bfc2438137bb079ebf03cca8

Files

850dfafac2700fbcfda5a7f54fafe2637da103d3bfc2438137bb079ebf03cca8
.dll windows:4 windows x86

da11d508fec06e7bdf0c398e2ba3e2bd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

rasapi32

RasHangUpA

user32

SetClipboardData

gdi32

OffsetViewportOrgEx

winmm

waveOutRestart

winspool.drv

DocumentPropertiesA

advapi32

RegCloseKey

shell32

Shell_NotifyIconA

ole32

CLSIDFromProgID

oleaut32

VariantCopy

comctl32

ImageList_Read

ws2_32

WSACleanup

wininet

InternetCloseHandle

comdlg32

GetFileTitleA

Exports

Exports

HuaxiaVolcanoInstall

Sections

.text
Size: 835KB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE