KnplEms[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

KnplEms.dll
Size

2.8MB
MD5

5a37707828f9807bc6a359f2a343e15f
SHA1

8dc64e5c6e1ee70cd72d3c630d3c0b7365e17e50
SHA256

204356eb2695d48a24ffa2e7bd9fec7a75fd6ab47c323c6311af04357f99ff3c
SHA512

1a0042cfb078d93214799c08846e1447083624778ef0767d2dd6ebfa429c68dd3eabe1ba2d7aba15929e1acea02e6da84b538812a6727b825440274583dc6128
SSDEEP

24576:tkwkXnSw8eCKVcuEfv+Ftje+P9Kh9gxSsfYfXEQpr:tOCUcV+FtjBQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
KnplEms.dll

Files

KnplEms.dll
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\KNPL\KNPL\KnplEms_Code_Main\KnplEms_15052024\KnplEms\obj\Release\netcoreapp3.1\KnplEms.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ