Examine[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Examine.dll
Size

10KB
MD5

896730c8faaebcde748c4aed14a9e0db
SHA1

9ea0207c3e1349b3f375a99357f78b49655ac60a
SHA256

bcbd95e11dea3bcdaab30c345d13eb8de91f4dbe35389cfe15107e202d367c77
SHA512

cb72b0368bf0fa35cae009d4014f9f5c4e1f6d419e46c55fdae1dd8e64f8c07e908d4d9ebd41e8a13a3fb13b2e63de8cc9842a45cbefa838da6bf5eb7499e063
SSDEEP

192:8k6yC7iEEEXZFTe3RnhdzXP+ZYWfSFgoFYE/5SH6T6:e77/8Rnrz2ZYhtYau

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Examine.dll

Files

Examine.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/_/src/Examine.Host/obj/Release/netstandard2.0/Examine.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ