DrectSoft[.]Core[.]Consultation[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

DrectSoft.Core.Consultation.dll
Size

522KB
MD5

e3e65f9cc36b8b07b7a887b95647dfd7
SHA1

7a22655d33c67f9c1f0eb1313b500d1a6de9fa94
SHA256

1767018b6e69b442af9d9314f951bc5f901468cf4e2332136c2269ef19dfa44d
SHA512

e60377eef2a797f5f6b57c73ef6f3f042928cb165a929d24f8c0c0230de2a39b1eefa0a22520acace0ac3bed7b2b0415498ecb9509edc0f04f526872c9fe1ee3
SSDEEP

6144:OVILs0DQZLkBcx1z+TJ2dsXVQtoCypkVJw/GGrPqb6VJ+YUi66:cIdqbk+Yx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DrectSoft.Core.Consultation.dll

Files

DrectSoft.Core.Consultation.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\Demo\EMRX86\Core\会诊系统\Consultation\Consultation\obj\Debug\DrectSoft.Core.Consultation.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 520KB - Virtual size: 520KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ