PowerCheque[.]dll | Triage

Sharing

General

Target

PowerCheque.dll
Size

1.2MB
MD5

20108ed7852c2461750a8978ffb0ab45
SHA1

87c057f7a5e09f1eef2a64bff6efb27e00ed50a3
SHA256

a1b4c45c1536665c81491b575c64278f14fcc1a8c4cdebbf6269e236012cd231
SHA512

2e782b48ad8836e001e3c63baad7405c7c2c79233ab7170ba19b0f18f665cc2d9f6536d47ac51513b4f9b5e16cabc0406cf9bb0b934f26651405daff22fde51b
SSDEEP

12288:sN+shvp3nMHcsbSbeEQ4g5HA11BA11qF7FKFKFCue/Ubu:gn3nMHvbIBGtA1DA14JYYAue/au

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PowerCheque.dll

Files

PowerCheque.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ