HuaxiaVolcanoInstall
Behavioral task
behavioral1
Sample
2b5227b0871cd1d380bbcebedfe186342488d74c62bdacaecdd7343e4434fc46.dll
Resource
win7-20240903-en
General
-
Target
2b5227b0871cd1d380bbcebedfe186342488d74c62bdacaecdd7343e4434fc46
-
Size
1.1MB
-
MD5
a5a53702505f37b43072b86a8fa1e405
-
SHA1
233de3cdf4943f066dd9521302d1ad64815d1da2
-
SHA256
2b5227b0871cd1d380bbcebedfe186342488d74c62bdacaecdd7343e4434fc46
-
SHA512
467c5b21d5630630b3018fdefc9a667eb52b16d5e05f1507b5a2e8afaa1d9ec98701ccda5e42d4bdfc9afdaf58d44cf2c6e0b9c9233d768ead221b9aef993a04
-
SSDEEP
24576:esCui6o5gcTtJxKasQp/3BVnuFhBzmAB4Zm6d/BwHHo2uO7FcM3Jz4N:CHFOcJJx/lp/B5OqmqXZihF7F732
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2b5227b0871cd1d380bbcebedfe186342488d74c62bdacaecdd7343e4434fc46
Files
-
2b5227b0871cd1d380bbcebedfe186342488d74c62bdacaecdd7343e4434fc46.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
UPX0 Size: - Virtual size: 4.5MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE