fe009198acece552c46f89a5944034910c12bce8883a5586a108dd2c8f5a2ff2 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fe009198acece552c46f89a5944034910c12bce8883a5586a108dd2c8f5a2ff2
Size

991KB
MD5

6ea6f9091ea56276fe4c13dddc48675f
SHA1

15300ba2f77ade7338d9f5a14afc21f9a8c7ac33
SHA256

fe009198acece552c46f89a5944034910c12bce8883a5586a108dd2c8f5a2ff2
SHA512

2d63300c9a532e602b4f81d942ac986bf9f292c8e2cb1a600ced14a4521004210d1d9b3bbf0541b4ec0a4ffa8ac6250dbfc25146a3c401c59625e6bc1738e95e
SSDEEP

24576:LncMOr5RJYcKbIy/MMMoDf1GvgLp1y2SEm+M:Lno5lc0MTDf1HN12D+M

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fe009198acece552c46f89a5944034910c12bce8883a5586a108dd2c8f5a2ff2

Files

fe009198acece552c46f89a5944034910c12bce8883a5586a108dd2c8f5a2ff2
.dll windows:4 windows x86 arch:x86

c8e1091cd36ea419818768aa5eb93f14

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

wsprintfA

gdi32

MoveToEx

winmm

midiStreamRestart

winspool.drv

DocumentPropertiesA

advapi32

RegQueryValueA

shell32

Shell_NotifyIconA

ole32

CoTaskMemAlloc

oleaut32

VarDateFromStr

comctl32

ImageList_GetImageInfo

ws2_32

inet_ntoa

comdlg32

GetFileTitleA

Exports

Exports

HuaxiaVolcanoInstall

Sections

.text
Size: 976KB - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE