99bc6e258a6fd117b21a0bbbf492d1c7a35b7dd8c76d7e5d59503578e7873a71 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

99bc6e258a6fd117b21a0bbbf492d1c7a35b7dd8c76d7e5d59503578e7873a71
Size

1.1MB
MD5

cfd11bf6bfa367dac10ecbb69f2d4d58
SHA1

8f013208781839e30a6266777eb003b1d4bc9851
SHA256

99bc6e258a6fd117b21a0bbbf492d1c7a35b7dd8c76d7e5d59503578e7873a71
SHA512

68159b54188cc360fa18494f1acde17d86a51729eee74dd40fbc4b5f186893a7032f615bef33e16f039712b1f3b61d2bccbe10b1bb80a393be95d4dbcf41b5e1
SSDEEP

24576:7qeJylj12Cuv6pn4cQt40wOsku6CrK3XRiZBARRXqJzM06Y:mj17Ig41t7fbCrK3hiZBsXqK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
99bc6e258a6fd117b21a0bbbf492d1c7a35b7dd8c76d7e5d59503578e7873a71

Files

99bc6e258a6fd117b21a0bbbf492d1c7a35b7dd8c76d7e5d59503578e7873a71
.dll windows:4 windows x86

50e943006823bb4fe2a7699aea7c1554

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

SetClipboardData

gdi32

RestoreDC

winmm

midiStreamRestart

msimg32

GradientFill

winspool.drv

DocumentPropertiesA

advapi32

RegQueryValueA

shell32

ShellExecuteA

ole32

CoTaskMemAlloc

oleaut32

VarDateFromStr

comctl32

ord17

ws2_32

recvfrom

comdlg32

GetFileTitleA

Exports

Exports

HuaxiaVolcanoInstall

Sections

.text
Size: 1.1MB - Virtual size: 4.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE