QimenPlat[.]ERP[.]dll | Triage

Sharing

General

Target

QimenPlat.ERP.dll
Size

20KB
MD5

7409a776208f209a9e8ee579943737d0
SHA1

ec0e9e676ab1d1edcefc04ac3e405824b5f28dbe
SHA256

7431ef1454bb79578a4be73708d3b7998b5b3c9fb55a4607e589ba727b832eaf
SHA512

4d4c89ba5429b76c36fb79b6525362a9aa19a1f5c78118bd3f4b27c3d68a3b0f4ac8503fca0e47a3012210c57a4d5b93012f200961f51dd6816c83e96aa68048
SSDEEP

384:CAlldbbN3tHnFBKyISc2/YATuMnBxwJd11zUEurEe:ftbbZtHSbq/14f1urEe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
QimenPlat.ERP.dll

Files

QimenPlat.ERP.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

H:\DotNet\QimenPlat\QimenPlatform.ERP\obj\Release\QimenPlat.ERP.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ