PCheckExe[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

PCheckExe.dll
Size

96KB
MD5

ed4666ee4fbb6891da3b4d70ae4675cb
SHA1

3c6154cf942efc0a19b554efe419a407cac14724
SHA256

a7a9ccd4e725cba00cb62732cbf49e9bea873254320dc7d5d70f4ca1cbda3ac1
SHA512

695be2dade1cd6fafcfa5876fa29c76f97164d7f4789a90e8b23d63200679a160972ba36b638f20f612b16af2cac105e05674599ea0c400a17423a142846a12f
SSDEEP

1536:xarTmmCs+LZ1rrATWD4zRSn9I+MLJZ2IdnRLFNJ348KROoi4Dm2Gela:wks+LZozY9ydN2nOx4za

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PCheckExe.dll

Files

PCheckExe.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

showfrmCheckExe

Sections

CODE
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 125B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ