Erp7[.]Custom[.]CheYou[.]UI[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Erp7.Custom.CheYou.UI.dll
Size

16KB
MD5

fdf8e5d22ada0b26b93f78a0f05e2b52
SHA1

0b6106dc8fad33cd4a29d43c93cbd7fec1b6baba
SHA256

67a79d7be368ac75cb7c768bf155b6cf31fc9fab7bfaedb339631741860de0af
SHA512

cde44e56fae930d49b33583337de37dd0afa8d873bd5f698baff2cb942ea8cb74393f803e7d35a82967aa802e3ee6fc0b37cf65ed5f8d70e681adf0f3eb4e7e4
SSDEEP

384:QlY2KUviTfX3kSIS4OWIIH1HS3q1/p1SpdsH:UY2KUvcPzWIIf1/pP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Erp7.Custom.CheYou.UI.dll

Files

Erp7.Custom.CheYou.UI.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

H:\DotNet\ERP7.NET\Hanson.Product.Erp7.CustomNew\CheYou\Hanson.Product.Erp7.Custom.CheYou.UI\obj\Debug\Erp7.Custom.CheYou.UI.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ