System[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

System.dll
Size

49KB
MD5

ed94c3afae936af81accfd935ea31373
SHA1

a4900235a02b3e439076237dd837db48e2f8380b
SHA256

3e5ea7b9f1e72bf0ba3a6b85d2135dc2f3ff938d1eeafc65482098afe397b916
SHA512

2495abfa46d4dd2fe8ae430835e523f014fda670e8c6995a9c6160377ede9bf56d653332a217107e684167c9d8679beacda8e20010df8b1f5a1a7b96d35d8daf
SSDEEP

1536:ghgVwQCbgdhHE4w0KZCJIoToKPNm6rPGoVyxZX875jzC3Ljiqjzif:ghgVwQQgdhHE4w0KZCJIoToKPNm6rPl1

Score

1^/10

Malware Config

Signatures

Files

System.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/05/2023, 19:03

Not After

08/05/2024, 19:03

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b0:fc:eb:11:59:65:40:7d:6f:2f:83:7d:0e:35:0d:62:f0:a6:d9:32:98:d5:60:26:35:3c:c4:ce:b1:56:4a:ff
Signer

Actual PE Digest

b0:fc:eb:11:59:65:40:7d:6f:2f:83:7d:0e:35:0d:62:f0:a6:d9:32:98:d5:60:26:35:3c:c4:ce:b1:56:4a:ff

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/_/artifacts/obj/System/Release/net7.0-linux/System.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7cCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

b0:fc:eb:11:59:65:40:7d:6f:2f:83:7d:0e:35:0d:62:f0:a6:d9:32:98:d5:60:26:35:3c:c4:ce:b1:56:4a:ffSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 37KB - Virtual size: 36KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

b0:fc:eb:11:59:65:40:7d:6f:2f:83:7d:0e:35:0d:62:f0:a6:d9:32:98:d5:60:26:35:3c:c4:ce:b1:56:4a:ff
Signer

.text
Size: 37KB - Virtual size: 36KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B