PMS[.]Employee[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

PMS.Employee.dll
Size

771KB
MD5

4a513562de6eaa5c5a2e3a30521565d6
SHA1

b257db60f5696c25e8884d243ef7d1702ffefcd0
SHA256

05199db4a9911c9bf94664e5bb5d9e1242f67f60f25a5fbeb691ea9db2a430de
SHA512

db59ece579294e3aa88a33590c4ed79c25964496cb620a0e8c91ea4421fd71e181b0d1810884ccf8894bc1c3b42d9fdeb1d1c450752436db1b5401680769ec78
SSDEEP

6144:0xyu91fGzEGg7eQGDhfEQlzE46M4KmwJQuL9qYx23xYydPA6DUl2rU/VqYf26qQs:CyYmJ2Ueft8jgHdkeL4L1zLg2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PMS.Employee.dll

Files

PMS.Employee.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\索思项目文件\亿安ERP\4.0版本\PMS_4.0\PMS.Employee\obj\Debug\PMS.Employee.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 769KB - Virtual size: 769KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ