kernelklient (2)[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

kernelklient (2).dll
Size

38KB
MD5

fce038e3a4b18a3240935e232825eb7c
SHA1

19e4462928b7feb6317f62ea20cee474b958a536
SHA256

69dcef51b9942d580c39452a1f258a80f069170ca8467ab44314d6eeeac88a2e
SHA512

3e46cfab572ab18628f184c7058258b4fe1b0162fc29756e60f07b11bb896fce5ed1dccfd57a3a25439882f2339d7dcde238adf262922355d72c53c265d4000b
SSDEEP

768:ct5LSWGinO3wScMtaeK2tYenXL/8Vs6TFHX1:ctTGOO3hcMxr7UV3TFHF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
kernelklient (2).dll

Files

kernelklient (2).dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\Tristan\Desktop\iis.Stupid.Template-1.3\obj\Debug\netstandard2.1\StupidTemplate.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ