Erp7[.]Mwm71[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Erp7.Mwm71.dll
Size

180KB
MD5

4cfe24cecae2fdcdd6b01c361d3d9a74
SHA1

3c74920e710ebbcdf12de4636536e5f269c8e7e2
SHA256

89b69beeaba71c7ca708b36a21aa291a0f6363fed68512a2649c085ab46cafe3
SHA512

81bf8db6e8a0971a8e0b96c86bcdd298b54af6e71fd905e70788305836056b62f0496b5b129074777e7eab29eea39bce977f4c4137f79291e7071f96ef3adbd3
SSDEEP

3072:8O9/s6yygMAj855HGSUlf6gDQaIa+dj/zgM:8c/smgtg55HGSUlf6gDQQ+7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Erp7.Mwm71.dll

Files

Erp7.Mwm71.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

H:\DotNet\ERP7.NET\Hanson.Product.Erp7\Mwm71.ETP\Hanson.Product.Erp7.Mwm71\obj\Release\Erp7.Mwm71.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 178KB - Virtual size: 177KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ