WinTariffPosting[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

WinTariffPosting.dll
Size

303KB
MD5

756879c88946f35f9662a777316b6ea9
SHA1

1b85a4d7c999a5f82c0f134af51ab09476773eb5
SHA256

a8aad40affc5ddc157cd88ade45fec7de456712a2e18a4dab62db685bf9d4a36
SHA512

c92e56ad136d53b79c65154ab7a0310ecb82d93484e53a0a6ec52a7289182dc3ff039babdd9a2647e7ebc14e7507bfb45ac8434ce34c2349da4c8eb584050aec
SSDEEP

3072:YIkGKl9eD/6UKtqWzLW3B+cODpQf/QiKYZ/Nhss4Ck0bMPPWyv4lrp:YzGKl9eDG1LW8cOl2/Qy1H

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WinTariffPosting.dll

Files

WinTariffPosting.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\SVNMC\WinTariffPosting\WinTariffPosting\obj\Debug\WinTariffPosting.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 301KB - Virtual size: 301KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ