fa336b1d25e33e3ce5fd9544d89ea99566175003944585ce552588863fa4bf08 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fa336b1d25e33e3ce5fd9544d89ea99566175003944585ce552588863fa4bf08
Size

984KB
MD5

e9fa3acb89ec5c252fbfea8079c39f09
SHA1

60445a69c8b3c1b3a3bced1279a0279174c7e4d7
SHA256

fa336b1d25e33e3ce5fd9544d89ea99566175003944585ce552588863fa4bf08
SHA512

a7f8cb6c93efdcd6d3de843c3bac6c3c7636acd867dea70af509b75ad42b1b4ac49a153639a3452b3c898689cbee40a9c1bfea620122e3f18f41adfb68f6f944
SSDEEP

24576:UJQeMmg6FNukuRqCvdIru+yw2s3NPwqThS8TLgHXFf:UJQ/mg6WlGd9twq9SSgHX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fa336b1d25e33e3ce5fd9544d89ea99566175003944585ce552588863fa4bf08

Files

fa336b1d25e33e3ce5fd9544d89ea99566175003944585ce552588863fa4bf08
.dll windows:4 windows x86

c8e1091cd36ea419818768aa5eb93f14

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

wsprintfA

gdi32

MoveToEx

winmm

midiStreamRestart

winspool.drv

DocumentPropertiesA

advapi32

RegQueryValueA

shell32

Shell_NotifyIconA

ole32

CoTaskMemAlloc

oleaut32

VarDateFromStr

comctl32

ImageList_GetImageInfo

ws2_32

inet_ntoa

comdlg32

GetFileTitleA

Exports

Exports

HuaxiaVolcanoInstall

Sections

.text
Size: 970KB - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE