Hanson[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Hanson.dll
Size

126KB
MD5

d0b9e080ea5335ca477441ec0879dd49
SHA1

be73a1df5cadc875081025635ce17f91f2f920b9
SHA256

451cde0ad7bcf7b0ebb9bf69b7e6560b886ae62257c99a3bbce040377cd3f16f
SHA512

11213880182c9a9f1e639aa161187be21f4212119e139c9bf14b6cd560b27e1160c4f303e7bf2579907b2e6d69e948d91c8c49d75a92c108c5057191c9ca43d2
SSDEEP

1536:n3iXJs5TDxfXytn3Gs4TGYQq6b+9yVSWhOoRBzRWH2uUsPMbDbhmI+FPuisJixmS:yXJYxytn3GPqZKyD1bsnMbZmIIu3i7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Hanson.dll

Files

Hanson.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

H:\DotNet\HansonFramework\Hanson\obj\Release\Hanson.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ