Microsoft[.]CertificateServices[.]PKIClient[.]Cmdlets[.]ni[.]dll | Triage

Sharing

General

Target

Microsoft.CertificateServices.PKIClient.Cmdlets.ni.dll
Size

646KB
MD5

5fd18bb2c6bc4467955f5680c6e5a025
SHA1

a454a85e1d9c8efe697132041c202e1cab6ce09e
SHA256

6d2317e109328d5bf344eb1aade67172987d6f81cd48974d2475455f17784f04
SHA512

4b34317d5be8c95721910b8509a7b8a2123caf76a8790d10b01554ab3d7535025aca44108bbad9fe80f9ebe2d3e8bf01379d3f3ed338dbd8cd9c544adee822b3
SSDEEP

6144:byKegz3509L31+wJbmR1ez2KK2O0MA2IPgjQgwycenfEbJoHIhGbA7jCNoWmcVtR:2nJyPIYMVKncloHIhGbAi2WmKEAZE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Microsoft.CertificateServices.PKIClient.Cmdlets.ni.dll

Files

Microsoft.CertificateServices.PKIClient.Cmdlets.ni.dll
.dll windows:5 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Microsoft.CertificateServices.PKIClient.Cmdlets.ni.pdb
Microsoft.CertificateServices.PKIClient.Cmdlets.pdb

Sections

.data
Size: 111KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 524KB - Virtual size: 523KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ