Erp7[.]Pos7CE[.]BLL[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Erp7.Pos7CE.BLL.dll
Size

66KB
MD5

6cfa9a0493b0295ca5ee55a2f4565776
SHA1

207ef36450f096fc719559f342f05203f88f6b19
SHA256

deb8e6fa233abd698c1528997e0062187a133cbf6d24c7de8bea3c686893d748
SHA512

285f56e42539fbf5e51e72488c08d4655d1e3b59d3f5afc4233ae4f0180fc5415ac7cbaea3fb62a905554640a5a5a441582dbd3a73e1135165b89caac379a1a5
SSDEEP

768:Y278v1yP5cyCDWEG2gL6x8ScgSrvhlEjCiIN+Z+SY2+ywTjQatEr6qA3Vn2GyFh8:YAa1GcTiEnguEnChYgLlrntuuK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Erp7.Pos7CE.BLL.dll

Files

Erp7.Pos7CE.BLL.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

H:\DotNet20180830\ERP7.NET\Hanson.Product.Erp7\Pos7CE\Hanson.Product.Erp7.Pos7CE.BLL\obj\Release\Erp7.Pos7CE.BLL.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ