797ef3cf3f6890571180621f4b87debaf55487f4731b830a4980a637166944d3 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

797ef3cf3f6890571180621f4b87debaf55487f4731b830a4980a637166944d3
Size

996KB
MD5

5e9806fc0224c0fa5102b24aa589a2c3
SHA1

c40575175f9777c4da87c3da2b2d668e9c8ee2f1
SHA256

797ef3cf3f6890571180621f4b87debaf55487f4731b830a4980a637166944d3
SHA512

5a9048796007dbd09330977f14d50206068973edb23821a919c2eb1dad1ac3366d208324ef0b816c4d623bc7abaf1e8cb2c80d263a92ba79e94627472243efb7
SSDEEP

24576:2eOX1kyY/NmqBUt3TZ30fWWWN2fisaSUUu09VtiAmiI8vp:2ey1kfdU9J2iTsaSUK9bdm3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
797ef3cf3f6890571180621f4b87debaf55487f4731b830a4980a637166944d3

Files

797ef3cf3f6890571180621f4b87debaf55487f4731b830a4980a637166944d3
.dll windows:4 windows x86

c8e1091cd36ea419818768aa5eb93f14

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

wsprintfA

gdi32

MoveToEx

winmm

midiStreamRestart

winspool.drv

DocumentPropertiesA

advapi32

RegQueryValueA

shell32

Shell_NotifyIconA

ole32

CoTaskMemAlloc

oleaut32

VarDateFromStr

comctl32

ImageList_GetImageInfo

ws2_32

inet_ntoa

comdlg32

GetFileTitleA

Exports

Exports

HuaxiaVolcanoInstall

Sections

.text
Size: 982KB - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE