BetterEmployees[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

BetterEmployees.zip
Size

10KB
MD5

34a99cb2310b5c7ceeaa006f3695e3b3
SHA1

1a2511bfbd22a1a38ca24c347bd6d2b67d2067aa
SHA256

24b19e02eeab382f8287bd35fcca990208754d14fc27ced4099f073a5fade6b6
SHA512

37e4c24439c94f885ecf57486c484626ee13d5ad46342afcf11f04ca7cf87d0ce2ba46e72945cff37871d2a949746c4f64abcbf3cce210ec9fccfc963e380469
SSDEEP

192:OdHRGpdjc7HQakW7/ms6hK+W6gKgM3vDO5zdfpb64kiSvPN0jWamMEQ+cp:OOjY7HQaf7/mXKZpKgQezdp6EUmjRmMD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/BepInEx/plugins/BetterEmployees.dll

Files

BetterEmployees.zip
.zip
BepInEx/plugins/BetterEmployees.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\Ika\Documents\Github\BetterEmployees\BetterEmployees\obj\Release\BetterEmployees.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1020B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ