YiSha[.]Enum[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

YiSha.Enum.dll
Size

10KB
MD5

e3b11aed1a8411ddf24a435b037ba817
SHA1

84b175f33b88b7de865f1687018fb873faf61ee2
SHA256

7495a96ca3e2e9766322c0bacf8711bea9d5196492bc7092423acbc17652866a
SHA512

e07d9b8434cd7407cb5ab554ed9e3cd0eb55b5ac2f0356c908020a49eb5391cb6f322196819c8b55d2762e201ebd9dc942631965ed5445f4c054f8cd8506e448
SSDEEP

192:SGq5AA3eTnmt6Kuo++PVkSpQ7mvRup+HmaLf0pLHaZFOoGv:MAAeSpfVxfvReIFODv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
YiSha.Enum.dll

Files

YiSha.Enum.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

E:\CodeOther\HospitalSurvey\YiShaAdmin\YiSha.Entity\YiSha.Enum\obj\Release\netcoreapp3.1\YiSha.Enum.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ