WCFWSPolling[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

WCFWSPolling.dll
Size

262KB
MD5

b85f3b83b38c29d16c8f84cff98dde97
SHA1

b3eafee7faa281a29bebb20faf956a612a3044ce
SHA256

0db8acad70dee66b21fb5d61c346a7fdf15886d7dcbd482882fd51b566478a8b
SHA512

c69bcd6c95711178f8ad44b7abac079db6927c2667330d9cf97dbd8a8941ae142a90b2a278da01b70c08a7d61bdc4e568c5bcdfc0d6c41ea978866b2706ff521
SSDEEP

6144:cpL3cLXyaHe3x7CXnPwGKTGMcLwQM3G/7NER+FBvkLp4h+romJ7gix89Tt6lRB3Y:cVCDfL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WCFWSPolling.dll

Files

WCFWSPolling.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\RMS.NETV9\WCFWSPolling\WCFWSPolling\obj\Release\WCFWSPolling.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 260KB - Virtual size: 259KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ