ZKWeb[.]System[.]Drawing[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ZKWeb.System.Drawing.dll
Size

351KB
MD5

edfd0ed9dae6f0b4d9b01c9a3a26dd2f
SHA1

ea9ebd85fd7d12fb4116ae6552da298042eef8cc
SHA256

ada1c3158f6eff6966a1844d8f55172f60fdb8c7a5bd78987b99b08b791fab61
SHA512

c52af8de308131bc99c509bd2cb3e2b3c855de49c6525bdad477d1eca017d1cab251f53b31d61179b3d76bda1e82a9ea7c337910b237bbfc53532a61e95c6753
SSDEEP

6144:SaD9MX+hQbC10SjQRGvE9KrY5e3MliTgBW/0NabopuH81yDwxmPkdqL4Z+XsFCzT:SasN8DVuGvFtS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ZKWeb.System.Drawing.dll

Files

ZKWeb.System.Drawing.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\ProgramData\Git\zkweb.system.drawing\src\ZKWeb.System.Drawing\obj\Release\netstandard2.0\ZKWeb.System.Drawing.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 349KB - Virtual size: 348KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ