Erp7[.]WebService[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Erp7.WebService.dll
Size

1.0MB
MD5

2ab0bbe74c891ee814f7c55b4965ceee
SHA1

573ead8d6fbefe66c8f45585b8c4a09d30d7f12e
SHA256

92c0f34b4abe44c6899dff73e4948cc63923d09d1a7ea4be2d2fd3be0f39fc42
SHA512

9e207abf1183cc0692a875e0fb47ee81b224ae515f58dd166d766c45a0b8b0330b0477ff0da0dcb779f72d10e8b86d72a001ca937e17f07db1f36c8c0f0c1cfa
SSDEEP

12288:S3qSwQGb01t1HYGalATiJ0QVWPQ422L50K:bXitKJzVWL2K

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Erp7.WebService.dll

Files

Erp7.WebService.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

H:\DotNet20180830\ERP7.NET\Hanson.Product.Erp7.WebService\obj\Release\Erp7.WebService.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ