Erp7[.]Mwm71[.]Call[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Erp7.Mwm71.Call.dll
Size

155KB
MD5

a7159f45f57883d3e01eea6d2eaf8bcb
SHA1

91d702d383d5fa32703cf0608b0e9ffe54a18c43
SHA256

499d8fe8e41a681a4e5440492f4594c93d7d70144a1b4b7837a73c9a6cc3efba
SHA512

750dc09098e240ae50e3bbf67da4450ce137165bd73358952d582ce5966683eb03e229675561a04bba0f46d7ca3ebbd02e813b87eba97761a11f34d8e6c7bf25
SSDEEP

1536:RKllw4EF9rOJRh2X8ijbZCMs+sUYDAuqL4S2TaWhAnN+oIOln:sEHrOdIZCMs+sUYDAuUkAnNPV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Erp7.Mwm71.Call.dll

Files

Erp7.Mwm71.Call.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

H:\DotNet20181206X\ERP7.NET\Hanson.Product.Erp7\Mwm71.ETP\Hanson.Product.Erp7.Mwm71.Call\obj\Release\Erp7.Mwm71.Call.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 153KB - Virtual size: 152KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ