EPPlus[.]dll | Triage

Sharing

General

Target

EPPlus.dll
Size

2.5MB
MD5

8297042f3bf9c66054a72d2341c5b7f3
SHA1

d68845090d9508d23d8e7352c58ae1d0ff88ec2a
SHA256

c59b9aa0c17e4c7a14817b4fd582aef60954ee0ecd9d631c367ba0b8bd138df2
SHA512

2e314becfc3707f3701f5393a78e77004d6ae32f38c4a47c694e5d99fb87b48c78fc4335a4006f9c4375346dce7a515a8d4fb8805353163d9224b769379478b2
SSDEEP

49152:tIqXAlvEOEJSqnDyYaXZn/Em5+kE8tOFH7tWp:BgvEjQs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
EPPlus.dll

Files

EPPlus.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\Mats\dev\EPPlusSoftware\EPPlus\src\EPPlus\obj\Release\net5.0\EPPlus.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 972B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ