VolcanoInstaller[.]exe

General

Target
VolcanoInstaller.exe
Size 79.0MB
Sample261104-vr8jmayt3n
SHA256 ad9980f7ee976fc67a044b0288127c1033b70526a804ee629fbcbcc5f805a62e
MD5 140faa23e6fa8dc19bff1a0951fa640e
SHA1 11b6a4b5de84d633277118bdf2c727bef28ae50f
SHA512 673de3bc41942e87220bed8cc744895e068fbb8efdb46f7eec0525e376e937e9c73566c17d1307658beae0e8701d12dbeefa0cbd18a3d98c7518b473aca09929
SSDEEP 786432:QQryTVkMzNORRcy/AtCWV5OtsFgtah1PoMDmi3XAu5ouCZMG:ZryhXzN0CHcWeiQu5ouaF
TLSH
T17708BE15B3E80A16E63FC27DC2638102E7F1B8531352D7CF4558EA992F63BC19A37266
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
VolcanoInstaller.exe

File Explorer

VolcanoInstaller.exe

.exe 79.0MB

VolcanoInstaller.exe

IMPHASH 8591f0a9d4ed420fb5952f1df0413445
SHA256 ad9980f7ee976fc67a044b0288127c1033b70526a804ee629fbcbcc5f805a62e
MD5 140faa23e6fa8dc19bff1a0951fa640e
SHA1 11b6a4b5de84d633277118bdf2c727bef28ae50f
SHA512 673de3bc41942e87220bed8cc744895e068fbb8efdb46f7eec0525e376e937e9c73566c17d1307658beae0e8701d12dbeefa0cbd18a3d98c7518b473aca09929
SSDEEP 786432:QQryTVkMzNORRcy/AtCWV5OtsFgtah1PoMDmi3XAu5ouCZMG:ZryhXzN0CHcWeiQu5ouaF
TLSH
T17708BE15B3E80A16E63FC27DC2638102E7F1B8531352D7CF4558EA992F63BC19A37266
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

20000

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetEnvironmentVariableW CreateDirectoryW CreateFileW DeleteFileW GetFileAttributesExW GetFileSizeEx ReadFile SetFilePointerEx WriteFile GetTempPathW CloseHandle GetLastError WaitForSingleObject Sleep GetCurrentProcessId GetExitCodeProcess CreateProcessW GetSystemTimeAsFileTime GetTickCount64 GetModuleFileNameW QueryPerformanceCounter GetCurrentThreadId InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW WriteConsoleW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetStdHandle GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress IsProcessorFeaturePresent HeapAlloc RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW VirtualProtect LoadLibraryExW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode

Name

.text

Size

74KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

226KB

Virtual Size

226KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

VolcanoInstaller.exe

kernel32

generic