657b95b7b0a3eb4abbe9ce73c67320eeab270d09b5f20d196ddcffb76d1322bc | Triage

Sharing

Copy URL Twitter E-mail

General

Target

657b95b7b0a3eb4abbe9ce73c67320eeab270d09b5f20d196ddcffb76d1322bc
Size

982KB
MD5

ff3a31fd6f171d46bd09b53246807900
SHA1

06a4bc8b006e6d4387932a2ae9a094887a07b11c
SHA256

657b95b7b0a3eb4abbe9ce73c67320eeab270d09b5f20d196ddcffb76d1322bc
SHA512

aa2787dd8daa8584e529c062be659def4d1eb2cc379dc48498ae4fb2e1076f2387ac9490dc10510df8c3f9465368a967645a51ebf1230cca93cd0db5fd26f3a1
SSDEEP

24576:xyGIiWAGQQf/ok3Ot8j/Zq/n2wfvTQdR1Pd+S:ooWANrk3IMin2wfvTQdR1l

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
657b95b7b0a3eb4abbe9ce73c67320eeab270d09b5f20d196ddcffb76d1322bc

Files

657b95b7b0a3eb4abbe9ce73c67320eeab270d09b5f20d196ddcffb76d1322bc
.dll windows:4 windows x86

c8e1091cd36ea419818768aa5eb93f14

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

wsprintfA

gdi32

MoveToEx

winmm

midiStreamRestart

winspool.drv

DocumentPropertiesA

advapi32

RegQueryValueA

shell32

Shell_NotifyIconA

ole32

CoTaskMemAlloc

oleaut32

VarDateFromStr

comctl32

ImageList_GetImageInfo

ws2_32

inet_ntoa

comdlg32

GetFileTitleA

Exports

Exports

HuaxiaVolcanoInstall

Sections

.text
Size: 956KB - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE