Erp7[.]Drp7[.]Call[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Erp7.Drp7.Call.dll
Size

2.8MB
MD5

c08384c06b7031b58da106356218492c
SHA1

ed5eac4ff74d30dfaa44076926ca22ff534a05d2
SHA256

a2ca030f6203266149c1027dd4c90b2e4f5e6a0ea1bf60bad129b8f8ea0b400e
SHA512

df27b41d116fc75edaba616ccdd6a48aa642cf95d2c99eaf51ea759cc4c8fa55a45c0bb7edc872c2ac10d2ab87415b30035f3afb7586a044fad244591a2827b6
SSDEEP

24576:tu02dzIZ4H+2Gz+n2K22B228aOrZMAXIohwlA3zof2lw7GF:tu0FI+aaZMAXIohwlA3zof2lzF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Erp7.Drp7.Call.dll

Files

Erp7.Drp7.Call.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

H:\DotNet\ERP7.NET\Hanson.Product.Erp7\Drp7\Hanson.Product.Erp7.Drp7.Call\obj\Debug\Erp7.Drp7.Call.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ