_WinTariffPosting[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

_WinTariffPosting.dll
Size

250KB
MD5

c1bb8fa2cf515ef1349708a365276e8d
SHA1

f295f70eaf9c00bec5293d40007de31022ae5432
SHA256

b7b2a289e0d5d0cbe294a8040b0ffaf36ecef81f2c2b0de43671208be08c4216
SHA512

c45518cf7f2abfbf259ee55a50753bb7c11c250449846589ebc9f66faa32190c398aa1805c3c1afd2cb02c815620694ce374387fdeb269c8e219214f4acc1034
SSDEEP

3072:HVhgV7ng7YwYbY/Y/YAf8frXNKG665dEo7qw7xqKOztekiV:HVWV7nkHy2y/f8bN4wApzt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
_WinTariffPosting.dll

Files

_WinTariffPosting.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Shared\Jagadeesh\WinTariffPosting\WinTariffPosting\obj\Debug\WinTariffPosting.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 248KB - Virtual size: 248KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ