WebFormDesigner[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

WebFormDesigner.dll
Size

144KB
MD5

f6f61dc7e524c34ebff80180ec2c3744
SHA1

925ba48f60b93040ed395262f0a4c2f2fe6db606
SHA256

28eed1339f4e725896bee0a29920c52c44a3b5be5f3a1b833bc0d913619a5aca
SHA512

c4e00c1f11a6609ae211b22f00029cebed2e22a865667ce37d992d5f3e6fcb736945144e30871c2e279a226f16630cf8d56313340ac8b3845723bd7f22778bf5
SSDEEP

1536:Jo3FrFtEAd+T8LY//ZlamPZBPQUp68pVJvcj2zAFmP0iWGfnYIHbRvlMbps:qFtEAd+T8LYJlTrn6ocoAFmP0iWGt3D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WebFormDesigner.dll

Files

WebFormDesigner.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

H:\DotNet20181206X\ERP7.NET\Hanson.Product.Erp7\OA\WebFormDesigner\obj\Release\WebFormDesigner.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 142KB - Virtual size: 142KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ