XYMES[.]ServiceCollector[.]dll | Triage

Sharing

General

Target

XYMES.ServiceCollector.dll
Size

248KB
MD5

ce1be534c27e39074df61a191115254b
SHA1

9307d0e70fe0110c8250eb3c54c0c268a6386366
SHA256

02a9c2040035b3abbbc5e87b8cf944a06c05f90b4e5bb1e6ad2e691890a61137
SHA512

e947687debd344f245c3f4fb6b3aab948a98b1ee1b594dc07697c14e80ab3513769bcc48dff152df877507f84e43bf0de5121f4b28856afc9d42dcd4b6bd2178
SSDEEP

3072:OCvmii5ehb+hUDv12kwGx3V+zYaN7+HB8h:OyphKhGvQkw03czrN7+H

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
XYMES.ServiceCollector.dll

Files

XYMES.ServiceCollector.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\work\MES\UROVO\Code\XYMES\ServiceCollector\obj\Debug\XYMES.ServiceCollector.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 246KB - Virtual size: 245KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ