bf8cd79e4726df490edd59c0a1bd73dfee14f8bea1d328194a536ed7f9c4f843 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bf8cd79e4726df490edd59c0a1bd73dfee14f8bea1d328194a536ed7f9c4f843
Size

988KB
MD5

30c69a6aeb847c34bf33b535d477d0bc
SHA1

2e1ece1a95dab94b17b9687b07cd08920af15ba9
SHA256

bf8cd79e4726df490edd59c0a1bd73dfee14f8bea1d328194a536ed7f9c4f843
SHA512

88e5e7d1d02c5486f5fdf87597ed164644ca15c20561fd0fe31ba6e79232ee103184ad41f9b4c87331326c9c63ea4664fc17deca4643f1d0d9debfe0d7ce2c7f
SSDEEP

24576:DlyrPZNv73l369LCFc7MPzgH+cjMQmr9E9OQ1+ZRtyN9:DaPZN39+uJa+c5nzSyN9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bf8cd79e4726df490edd59c0a1bd73dfee14f8bea1d328194a536ed7f9c4f843

Files

bf8cd79e4726df490edd59c0a1bd73dfee14f8bea1d328194a536ed7f9c4f843
.dll windows:4 windows x86

da11d508fec06e7bdf0c398e2ba3e2bd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

rasapi32

RasHangUpA

user32

SetClipboardData

gdi32

OffsetViewportOrgEx

winmm

waveOutRestart

winspool.drv

DocumentPropertiesA

advapi32

RegCloseKey

shell32

Shell_NotifyIconA

ole32

CLSIDFromProgID

oleaut32

VariantCopy

comctl32

ImageList_Read

ws2_32

WSACleanup

wininet

InternetCloseHandle

comdlg32

GetFileTitleA

Exports

Exports

HuaxiaVolcanoInstall

Sections

.text
Size: 974KB - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE