Erp7[.]Custom[.]CheYou[.]BLL[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Erp7.Custom.CheYou.BLL.dll
Size

19KB
MD5

8d5e4fe74acf292c089a5179f19ee8c6
SHA1

4133a78c746752a4f64cc33a3f515114f1e8a54a
SHA256

283b63ca212881c278e36818bbe732379e65371dc779e3feafbf90dc8327ebf8
SHA512

89f87df6dd821d778c3c916cc4a60e1f914e320f315ef7d680998de960717e824f883c4a07cdc3a5cb4e1cdc2e467712732200fa1a74fc2c62cf0d75f25105bf
SSDEEP

192:ROKsxmyk+XB7P+v/hDqyQfptG82U9pZ+kuqE+GWGwF7FOoU/5:RONNXB7W3wb82Ah/5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Erp7.Custom.CheYou.BLL.dll

Files

Erp7.Custom.CheYou.BLL.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

H:\DotNet\ERP7.NET\Hanson.Product.Erp7.CustomNew\CheYou\Hanson.Product.Erp7.Custom.CheYou.BLL\obj\Debug\Erp7.Custom.CheYou.BLL.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ