q[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

q.dll
Size

40KB
MD5

9c7f2fe0ab6d966c80174d8cf8d2d428
SHA1

f83600a933a43f1505d31121114d457cde253fe4
SHA256

7858d3891680e7fb27d4b2ce75f5acd77501fc5ff19b5a7b2e2e09a30d438af7
SHA512

0d66f13230161e73d733f9816c47a6627a8dd02ece0ced008084906e3671daad4e6ab5bf88115e14c793c68b1de096d8b3702cb9275e9a16d42184f893d84a5c
SSDEEP

768:FRV7CuUvravpfs9ZxA1eDnK4rSxrjKbj74DxXVnz3jiB:vVWnmu9Z1nKrN2jch5z3jc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
q.dll

Files

q.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\杨涛\YTC\q\q\obj\Debug\q.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 712B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ