EasyFAS[.]Modules[.]Orders[.]Service[.]dll | Triage

Sharing

General

Target

EasyFAS.Modules.Orders.Service.dll
Size

342KB
MD5

64e7fea879d81b8c5cc977df0fdc9d25
SHA1

8a63df5de0fa581e2f989fca418983473f9083f2
SHA256

2b167c89227d5ed3f0d9cba93670e7dadb6a7df8ca242ad0b0ce300f4c4a1c99
SHA512

0f2107ce732b4dde6ac44b979630d55acee4764c0657d7c305b3d040a657b0edbc1b5a14863d2ac34716a7088a152cf4d68c1870c9529cea1813c23033ce4a04
SSDEEP

6144:pBhfjzu1X89FvUCQDm0MPrc+TT3x8cQCkoNTWnehxfaHAyH+TeoA2+beF:7hfHu1X89qm0cc+GVCkKXRDgoA2+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
EasyFAS.Modules.Orders.Service.dll

Files

EasyFAS.Modules.Orders.Service.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Product2\IMES\trunk\Modules\Order\Service\obj\Release\EasyFAS.Modules.Orders.Service.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 340KB - Virtual size: 339KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ