ea299a52a80347370997372cde223763df65ed22156195e0d4c7d6890616d6c9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ea299a52a80347370997372cde223763df65ed22156195e0d4c7d6890616d6c9
Size

1.1MB
MD5

a71f0ac3dd37e3569169680d08f90ed6
SHA1

9c4d2d75f4cc5a4919221d3b1f3fdd71ec47629d
SHA256

ea299a52a80347370997372cde223763df65ed22156195e0d4c7d6890616d6c9
SHA512

2a909dc46173a6a850627bc74fbece22cbc3a695f7754a0e965797975ba285bcaf27e30f53116de2d98447d83de70924878a2bef5cac7db4013406a7d7f37fb7
SSDEEP

24576:HTlPAP+wx6ljPFokTQNLYJSls+uNePPk/rwhkKUxtlzpmM:HZKn9kTtYM/XKUDFpmM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ea299a52a80347370997372cde223763df65ed22156195e0d4c7d6890616d6c9

Files

ea299a52a80347370997372cde223763df65ed22156195e0d4c7d6890616d6c9
.dll windows:4 windows x86 arch:x86

5fd5e4e216cee6cdaac34db5e6281d6b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

rasapi32

RasHangUpA

user32

SetClipboardData

gdi32

SetPolyFillMode

winmm

waveOutRestart

winspool.drv

ClosePrinter

advapi32

RegQueryValueA

shell32

ShellExecuteA

ole32

CoTaskMemAlloc

oleaut32

VarDateFromStr

comctl32

ImageList_Create

ws2_32

recv

wininet

InternetCloseHandle

comdlg32

GetFileTitleA

Exports

Exports

HuaxiaVolcanoInstall

Sections

.text
Size: 1.1MB - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE