2fb06b8ced3186e63ebd56168572e14c9253895cfee31b9c98a4288e9509b7bf | Triage

Sharing

General

Target

2fb06b8ced3186e63ebd56168572e14c9253895cfee31b9c98a4288e9509b7bf
Size

1.1MB
MD5

2e130e970a19d99422ca749ede571db7
SHA1

7317f332c0c1db322ff2e86b2726d6942c48973e
SHA256

2fb06b8ced3186e63ebd56168572e14c9253895cfee31b9c98a4288e9509b7bf
SHA512

7c16ce45e51c8c715395fdb9326604567f9520edc1f932ae9b9c8370c15dc920a41925133ea641070b4b0b62cb25fc261f7fec2541003ccc4c9084c0c02e0ec5
SSDEEP

24576:Ry9byZ7GAiBvXdAblNB3PUN4ByNayPl13r6ipIEEOWo/xL:R8bW7GAlhfUN4gF1kEEOr5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2fb06b8ced3186e63ebd56168572e14c9253895cfee31b9c98a4288e9509b7bf

Files

2fb06b8ced3186e63ebd56168572e14c9253895cfee31b9c98a4288e9509b7bf
.dll windows:4 windows x86

5fd5e4e216cee6cdaac34db5e6281d6b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

rasapi32

RasHangUpA

user32

SetClipboardData

gdi32

SetPolyFillMode

winmm

waveOutRestart

winspool.drv

ClosePrinter

advapi32

RegQueryValueA

shell32

ShellExecuteA

ole32

CoTaskMemAlloc

oleaut32

VarDateFromStr

comctl32

ImageList_Create

ws2_32

recv

wininet

InternetCloseHandle

comdlg32

GetFileTitleA

Exports

Exports

HuaxiaVolcanoInstall

Sections

.text
Size: 1.0MB - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE