03873a6463a16c3a9f3de216529f96bc2abb374c4cb0e588dbc3cf4fc0507c34 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

03873a6463a16c3a9f3de216529f96bc2abb374c4cb0e588dbc3cf4fc0507c34
Size

47KB
MD5

b4b1238e929c05604c80d1b244973619
SHA1

2b09cb6bb3a653996fd1d774838c92eb1420602e
SHA256

03873a6463a16c3a9f3de216529f96bc2abb374c4cb0e588dbc3cf4fc0507c34
SHA512

febc3d67cc1565fc061672f95a261067ccc9833451cd545955a19ef8b9c766af5266abb9c90a974323b2a01c031f86578322d44a77378707a040680021cf094b
SSDEEP

768:2IPAOEVPa4iPBl2V0qkZkM11l6G2UbcDDRYFOqbTSmN9:xEU4iArkZkMAGHSMS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
03873a6463a16c3a9f3de216529f96bc2abb374c4cb0e588dbc3cf4fc0507c34

Files

03873a6463a16c3a9f3de216529f96bc2abb374c4cb0e588dbc3cf4fc0507c34
.dll windows:5 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Microsoft.TeamFoundation.TestManagement.PcwPlugin.ni.pdb
C:\A\1\3\obj\Release.AnyCPU\VSIntegration.Client\PcwPlugin\Microsoft.TeamFoundation.TestManagement.PcwPlugin.pdb

Sections

.data
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ