PMS[.]Sale[.]Server[.]dll | Triage

Sharing

General

Target

PMS.Sale.Server.dll
Size

66KB
MD5

3521c0b804e38927338168eac4dc0343
SHA1

bbc5cd405f0c03c84fe1ff199018dd7cab7d8e56
SHA256

2d102f22cfe464c5da69a220705b4b1343432ccf934235bc83c84a4db08b7e5b
SHA512

473ea0212cc8368073b7f3ef2be059bd0a4b50f2188b787008a43659e47d949d189b44a41cdc92e74a86246fa2b2d1b8242bba2ce506b1befc94f3347cac6810
SSDEEP

768:v0fKT+rMcvPv3HaHXVc8E1toFccj5LNqH9fwSXcAFtAprTtUxCz:sDrMoPvq3VxMij5LNqHldhtA7UAz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PMS.Sale.Server.dll

Files

PMS.Sale.Server.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\索思项目文件\亿安ERP\4.0版本\PMS_4.0\PMS.Sale.Server\obj\Debug\PMS.Sale.Server.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ