WinTariffPosting[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

WinTariffPosting.dll
Size

328KB
MD5

c50b95ef7d783f5dfb9ea327823d75bb
SHA1

47d2d8ac00b5cf2b5fd6178294d097e2f6b80f52
SHA256

551a230dc6a46a64773347f826e6307cd0c4dc5d678d8b66fb4f0c835984feb8
SHA512

9ed4ba1b4ab0c8f7a1f00c1b153b787d4da751dcfc2bdc5aa6456766273caebd16344317c27035b1f74238e47f39cd1861cc3db9ae8207756335c74037717111
SSDEEP

3072:drPWJl9VPj3OgI9eaZ2dO7vCj9o8kMBL8qTR5dzpG8rvOWi9S/xQlXwEcLFQZu:do5PjegIn2dO7vCj9oMBLJTRrzFOWi6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WinTariffPosting.dll

Files

WinTariffPosting.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\SVN_SideMenu\WinTariffPosting\WinTariffPosting\obj\Debug\WinTariffPosting.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 326KB - Virtual size: 326KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ