8f5ed9b6768ebe89737c0b10a15619aca29d954a74caaf2d985a7d75c98bdfef | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8f5ed9b6768ebe89737c0b10a15619aca29d954a74caaf2d985a7d75c98bdfef
Size

861KB
MD5

a8d5a217f30616f416f74b3e171e9994
SHA1

9a7b79ba5ae1a565b0cb117666ace9944317fd63
SHA256

8f5ed9b6768ebe89737c0b10a15619aca29d954a74caaf2d985a7d75c98bdfef
SHA512

9906beb1f66a351df240abbf3c6234037577d73827f4ebf2d9be11522dc6f79678b949a91938dbd69271ee6859064087b01158fca0eb558a02644a5e342b0789
SSDEEP

24576:AGMljPqhQauJPhL6NkrXbU2kzyzqpiTsfpyXUpvKtHU9FH:YVWQauJPYNuXbfkzoAiupIqit0r

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8f5ed9b6768ebe89737c0b10a15619aca29d954a74caaf2d985a7d75c98bdfef

Files

8f5ed9b6768ebe89737c0b10a15619aca29d954a74caaf2d985a7d75c98bdfef
.dll windows:4 windows x86

1c76d65ed943aab0d880ac7c07c83910

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetMenuItemID

gdi32

MoveToEx

winmm

waveOutPause

winspool.drv

ClosePrinter

advapi32

RegQueryValueA

shell32

ShellExecuteA

ole32

CoTaskMemAlloc

oleaut32

VariantCopy

comctl32

ImageList_Draw

ws2_32

closesocket

comdlg32

GetFileTitleA

Exports

Exports

HuaxiaVolcanoInstall

Sections

.text
Size: 836KB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE