ffd6cea4a5ec4de6a09c56d1f496160879ab41aec0e2eeddd7c5cf89aa355813 | Triage

Sharing

General

Target

ffd6cea4a5ec4de6a09c56d1f496160879ab41aec0e2eeddd7c5cf89aa355813
Size

59KB
MD5

cab8dfb3770b770abd1f499b6a0c8cd2
SHA1

b0e444e7c114dc1a705b9a882a928556fb4b72f9
SHA256

ffd6cea4a5ec4de6a09c56d1f496160879ab41aec0e2eeddd7c5cf89aa355813
SHA512

f92a63e709e67f3a82b6770c16cbf1c8c2ca8ff1b35697baef5160022c6c54186f271b0405396b533a1e6e8e886ba33cd5754c450ea664cc04bbdc8435d12731
SSDEEP

1536:+T3u4/XUVLnwklhNnhd7+p///A2zbUDmYiKTpTTD81D:EOw6qzIiVKTBTDa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ffd6cea4a5ec4de6a09c56d1f496160879ab41aec0e2eeddd7c5cf89aa355813

Files

ffd6cea4a5ec4de6a09c56d1f496160879ab41aec0e2eeddd7c5cf89aa355813
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Rehm.ViCon.Service.Plugin.Protecto.Deployment.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ