Pomelo[.]EntityFrameworkCore[.]MySql[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Pomelo.EntityFrameworkCore.MySql.dll
Size

412KB
MD5

ee4be55be7d811e11a08aa9270485aee
SHA1

464e2c280ff37c3e75fc5745cab976b497a28821
SHA256

3f7ff884fcbf3ba36953ccb53f1f345548d904b46dd44c73590dafe436624c13
SHA512

0d4b0ebe0a3158f0ce101730502a19db8df1bce3bbd4ca0d66a58f56b7ff326a3bbdb45e6b30397a08f47a5f82ed10e108f779cbab0c85b21e61a82ba3848760
SSDEEP

6144:BuAQm96MuTdWUlS1dQWmyQHqUYtx+fCVUdwWFP8GY9lwh9bDsW1SAI:Bu/+gCbYwS8GhboW1S

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Pomelo.EntityFrameworkCore.MySql.dll

Files

Pomelo.EntityFrameworkCore.MySql.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/_/src/EFCore.MySql/obj/Release/net6.0/Pomelo.EntityFrameworkCore.MySql.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 409KB - Virtual size: 409KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ