EasyFAS[.]Modules[.]Orders[.]DataAccess[.]dll | Triage

Sharing

General

Target

EasyFAS.Modules.Orders.DataAccess.dll
Size

2.5MB
MD5

5331e6da29660eba6db937dca4cdfaa6
SHA1

b5da1c29445d188b92ff184bdd261d0c12e8f4b9
SHA256

798dd1c93c75704fad2f6b1eec031e7aad1c3a7568a3098e50bcf0174bff9b9a
SHA512

8c8729868fa4b84503fc1ed9fd3a58b1518d0760e542f8c20273fd684c7eddbbe9dbb2d22872da9a83e8a75103f95a00e3be8fbb9429abf0a121a35c318a3eda
SSDEEP

12288:kggTEdQaOkWJYry0jOXKyBEdalvOtfhCCSF9D:qTEdQaFiYNO6yadalvOt8D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
EasyFAS.Modules.Orders.DataAccess.dll

Files

EasyFAS.Modules.Orders.DataAccess.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Product2\IMES\trunk\Modules\Order\DataAccess\obj\Release\EasyFAS.Modules.Orders.DataAccess.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ