0b3a81242122297ed47283481807fcfeb60c8643035a054d99a1a536c8bdbe81 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0b3a81242122297ed47283481807fcfeb60c8643035a054d99a1a536c8bdbe81
Size

963KB
MD5

7bfea54470261249a2c50084ddb4cdf8
SHA1

28441a21b04ffc35e0029e9548ed58befb79f1da
SHA256

0b3a81242122297ed47283481807fcfeb60c8643035a054d99a1a536c8bdbe81
SHA512

348e46b2f0950c7ec0b2c1650cbcc6f2ea49ba16b7f5843a7ce9ec2aac925b7c43c01dbea51e5101ba79bc1681b8bd2c5db4fbc5e1b20209f46374b2608a25fc
SSDEEP

24576:mXLACWtrlxUM5YtFGLcy+NMLvaxiT7z0JB13tG:oWBj14bNMLtcH3tG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b3a81242122297ed47283481807fcfeb60c8643035a054d99a1a536c8bdbe81

Files

0b3a81242122297ed47283481807fcfeb60c8643035a054d99a1a536c8bdbe81
.dll windows:4 windows x86 arch:x86

c8e1091cd36ea419818768aa5eb93f14

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

wsprintfA

gdi32

MoveToEx

winmm

midiStreamRestart

winspool.drv

DocumentPropertiesA

advapi32

RegQueryValueA

shell32

Shell_NotifyIconA

ole32

CoTaskMemAlloc

oleaut32

VarDateFromStr

comctl32

ImageList_GetImageInfo

ws2_32

inet_ntoa

comdlg32

GetFileTitleA

Exports

Exports

HuaxiaVolcanoInstall

Sections

.text
Size: 938KB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE