DownloadR2.zip
- SHA256 da0b07e2452d9a2cdbb16838cfc886f81d7129a255cdc591eeee8458519892b2
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
VolcanoUpdater.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
VolcanoUpdater.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target DownloadR2.zip
- Size 4.4MB
- Sample261001-kfgxeszakb
- SHA256 da0b07e2452d9a2cdbb16838cfc886f81d7129a255cdc591eeee8458519892b2
- MD5 1f329793e4fa72da313d5b318ccba7fd
- SHA1 2c214e188f12183fdfaf43b7d6af421d6be6f702
- SHA512 877b4ff6ef2408c84f300675e708bac7079f228bc8b6389678333b5a62ebb062bee6e5d4ac2c579621684c73cb89abea63cbd54a0362bf8b139e05ded05377c1
- SSDEEP 98304:3p0187K5UpKVo35vT0nkVZaqBYEee7eOXxcOB0r/Oe6DFZZDi8DhUR:77K5UpKVop7okVPBxe2cO2r4tO8DC
- TLSH T159263339E92D563FDDEA0985E05D5389C98D1A77FE8ECE80C08EEE7441F14461B78A8C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/VolcanoUpdater.exe
File Explorer
-
DownloadR2.zip.zip 4.4MB
-
VolcanoUpdater.exe.exe 4.5MB
VolcanoUpdater.exe
- SHA256 d7907e93b9ee8ed2ac0b4c4f5c20a961a1a0bee0000fbbd3a57e87ecbc846899
- MD5 690b0be88351c438ff24dbc67e50ae96
- SHA1 562c1ae7e92574fe1e73b1a9734abf9f2cef866b
- SHA512 de4fd249788e9032ebc9432af3afefb0a7f1f0521d353844d366706f41e7c0ac28fe1eac6855daa6a32e91e31f08366955368fb21ebac317d7c37d1879fe9a02
- SSDEEP 98304:wRe1AiWLNADn73tAbIgruw1mPx5C3CcfaNNfzJ2dM9jvO7je:QiWLNADn73+bIBN55CSfvLjAC
- TLSH T1C426333B29658B65FEDD19303371D248F3B7FA32BECFD700940F849221956885BE2169
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
8269912
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
Size
424KB
Virtual Size
782KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
86KB
Virtual Size
192KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
4KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
22KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
co
Size
Virtual Size
6.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
3.9MB
Virtual Size
3.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
generic
count=196, id=261, version=33136,
count=19, id=260, version=33136,
count=9, id=259, version=33136,
count=8, id=253, version=33030,
count=2, productName=Unmarked objects (old),
count=18, id=260, version=33030,
count=18, id=259, version=33030,
count=93, id=261, version=33030,
count=20, id=261, version=33134,
count=206, id=260, version=33134,
count=13, id=257, version=33136,
count=238, id=1, productName=Unmarked objects,
count=1, id=265, version=33134,
count=1, id=255, version=33134,
count=1, id=258, version=33134,