ChoETL[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ChoETL.dll
Size

1.0MB
MD5

649ee1cc4bf2eba414cd611546d170db
SHA1

127e707254d658d650e60a525f7e97fe2ea2b194
SHA256

a2b9759a1fade0cd0ef8d240e60e2ce1c40663ad6be7a34770015d89b32252f7
SHA512

b9d59fa1d4d85e905c3286dbc10b68944c85a7a432079bbd2a0e415296a047947227f362e59df566cde4abd6c393380a4f6ba96f88343b01e0d6a3624be61004
SSDEEP

12288:KKUGKwVNlUa6qZDp0hBcM1cMXq3Kqypnc2WaxnnVwXNQ1rOceMtODr:RHLDocM1cGLxn7WaxnVwX4Ota

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ChoETL.dll

Files

ChoETL.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Projects\GitHub\ChoETL\src\ChoETL\obj\Release\ChoETL.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ