BW[.]ERPPOS[.]Install[.]exe | Triage

Sharing

General

Target

BW.ERPPOS.Install.exe
Size

266KB
MD5

e53c3d513ab75818b69ba22ea9777325
SHA1

dfacecf42efcd599ea4652dd25654528ccb8b05c
SHA256

0583e51cc416a6d389a8e6852c0aca414293b0c17b8e1cd957761fda83ff1afb
SHA512

5337bb09943a7608e8775d07b02862f830ca6b234e691c8ecbc8f9ca0fd743ca631bd7b76f5a964d37297fac6965dda69615ddfe8a5e1f7235bad912a53eecec
SSDEEP

1536:PJ6p+Jrk4n22x2222y2222PYHaHFxJMEkYnNl4PThRAD5l5DH+lmRK+/Ju+ZpBKs:PJs+ZmNlsV25DHASK+/8eBKwF1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BW.ERPPOS.Install.exe

Files

BW.ERPPOS.Install.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\wanglf\myproj\百威ERPPos服务\BWERPPOS\BW.ERPPOS\BW.ERPPOS.Install\obj\x86\Debug\BW.ERPPOS.Install.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 105KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 160KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ