PMS[.]Sale[.]dll | Triage

Sharing

General

Target

PMS.Sale.dll
Size

519KB
MD5

0b70db623931c68390bdd1f9505b9f3d
SHA1

dcf84c736e2e806d42fe2920a0a2f33ed0c9e89f
SHA256

8f85417d519dc8698744a0e49d4cc05eea783394133d69e4a69083b610e3528c
SHA512

d712804e4f9617f6466ed92738ac54e57112acfbdc8a1e902139a416fab4ec1df97dc6b9513ac6bf504777f0ca01a70b67c34ea3c1c0f7b986d2192158ecf90c
SSDEEP

12288:vDHv9jZkr8smkNl+jN2cT8gU5JHsXdDsMz3mDr0j6XLEJ2Se20schTNoRgYwog:LdUO2vOl8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PMS.Sale.dll

Files

PMS.Sale.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\索思项目文件\亿安ERP\4.0版本\PMS_4.0\PMS.Sale\obj\Debug\PMS.Sale.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 517KB - Virtual size: 516KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ