c705d77e311b9e9a4282d0e92f7e7eb2812296b6da6e307ee18c668a9b09c21d
- SHA256 c705d77e311b9e9a4282d0e92f7e7eb2812296b6da6e307ee18c668a9b09c21d
Overview
overview
3Static
static
3样本/App...tj.dll
windows10-2004-x64
1样本/App...tj.dll
windows11-ltsc_2024-x64
1样本/App...l3.dll
windows10-2004-x64
1样本/App...l3.dll
windows11-ltsc_2024-x64
1样本/App...4r.dll
windows10-2004-x64
1样本/App...4r.dll
windows11-ltsc_2024-x64
1样本/App...xo.dll
windows10-2004-x64
1样本/App...xo.dll
windows11-ltsc_2024-x64
1样本/App...zg.dll
windows10-2004-x64
1样本/App...zg.dll
windows11-ltsc_2024-x64
1样本/App...dh.dll
windows10-2004-x64
1样本/App...dh.dll
windows11-ltsc_2024-x64
1样本/App...hf.dll
windows10-2004-x64
1样本/App...hf.dll
windows11-ltsc_2024-x64
1样本/App...od.dll
windows10-2004-x64
1样本/App...od.dll
windows11-ltsc_2024-x64
1样本/App...bi.dll
windows10-2004-x64
1样本/App...bi.dll
windows11-ltsc_2024-x64
1样本/App...lz.dll
windows10-2004-x64
1样本/App...lz.dll
windows11-ltsc_2024-x64
1样本/App...xh.dll
windows10-2004-x64
1样本/App...xh.dll
windows11-ltsc_2024-x64
1样本/Asp...ds.dll
windows10-2004-x64
3样本/Asp...ds.dll
windows11-ltsc_2024-x64
3样本/Inf...pi.dll
windows10-2004-x64
1样本/Inf...pi.dll
windows11-ltsc_2024-x64
1样本/Lea...pi.dll
windows10-2004-x64
1样本/Lea...pi.dll
windows11-ltsc_2024-x64
1样本/Lea...as.dll
windows10-2004-x64
1样本/Lea...as.dll
windows11-ltsc_2024-x64
1样本/Lea...il.dll
windows10-2004-x64
1样本/Lea...il.dll
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
样本/App_Web_2m0c5qtj.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
样本/App_Web_2m0c5qtj.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
样本/App_Web__admin.cshtml.639c3968.hdcdqyl3.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
样本/App_Web__admin.cshtml.639c3968.hdcdqyl3.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
样本/App_Web__custmerformpreview.cshtml.639c3968.w8bixs4r.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
样本/App_Web__custmerformpreview.cshtml.639c3968.w8bixs4r.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
样本/App_Web__form.cshtml.639c3968.vpoyvxxo.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
样本/App_Web__form.cshtml.639c3968.vpoyvxxo.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
样本/App_Web__index.cshtml.639c3968.lwdowszg.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
样本/App_Web__index.cshtml.639c3968.lwdowszg.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
样本/App_Web_a3cckjdh.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
样本/App_Web_a3cckjdh.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
样本/App_Web_awiukahf.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
样本/App_Web_awiukahf.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
样本/App_Web_c5534dod.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
样本/App_Web_c5534dod.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
样本/App_Web_civvcxbi.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
样本/App_Web_civvcxbi.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
样本/App_Web_trt3t4lz.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
样本/App_Web_trt3t4lz.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
样本/App_global.asax.6ajlkhxh.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
样本/App_global.asax.6ajlkhxh.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
样本/Aspose.Words.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral24
Sample
样本/Aspose.Words.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral25
Sample
样本/InfoEarth.Application.JCYJ.WebApi.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
样本/InfoEarth.Application.JCYJ.WebApi.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
样本/Learun.Application.SSOWebApi.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
样本/Learun.Application.SSOWebApi.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
样本/Learun.Application.WebAreas.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
样本/Learun.Application.WebAreas.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
样本/Learun.Util.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
样本/Learun.Util.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target c705d77e311b9e9a4282d0e92f7e7eb2812296b6da6e307ee18c668a9b09c21d
- Size 3.7MB
- Sample260723-l5aebabe87
- SHA256 c705d77e311b9e9a4282d0e92f7e7eb2812296b6da6e307ee18c668a9b09c21d
- MD5 7f38fd18c2b14e73adf3f88ca2a92436
- SHA1 1cc53a99f4158a1973fa42dc4a9f41440082971e
- SHA512 4342ef38ef3de02cc972aa933460a3895f2fbbf2d49eda0856c49203d3f7d96d6125fd2abb11bfe179bbfd3d2137faf95e8e26853552fd513fd9ea006329cfc9
- SSDEEP 98304:9CWMzoPEVqcjNIgY4DXMG4GR6yx7xX5a5cBu8vtLh+1BHSSHYqk:9fPEVqcjNfY+xVX5aC7tliSuk
- TLSH T1BC0633A875D9006FEC77B7BB087C9C7975F2A378E035D0B080347101A5A4B359BED69A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 17 IoCs
Checks for missing Authenticode signature.
resource unpack001/样本/App_Web_2m0c5qtj.dll unpack001/样本/App_Web__admin.cshtml.639c3968.hdcdqyl3.dll unpack001/样本/App_Web__custmerformpreview.cshtml.639c3968.w8bixs4r.dll unpack001/样本/App_Web__form.cshtml.639c3968.vpoyvxxo.dll unpack001/样本/App_Web__index.cshtml.639c3968.lwdowszg.dll unpack001/样本/App_Web_a3cckjdh.dll unpack001/样本/App_Web_awiukahf.dll unpack001/样本/App_Web_c5534dod.dll unpack001/样本/App_Web_civvcxbi.dll unpack001/样本/App_Web_trt3t4lz.dll unpack001/样本/App_global.asax.6ajlkhxh.dll unpack001/样本/Aspose.Words.DLL unpack001/样本/InfoEarth.Application.JCYJ.WebApi.dll unpack001/样本/Learun.Application.SSOWebApi.dll unpack001/样本/Learun.Application.WebAreas.dll unpack001/样本/Learun.Util.dll unpack001/样本/jna17855984959411834595.dll
File Explorer
-
c705d77e311b9e9a4282d0e92f7e7eb2812296b6da6e307ee18c668a9b09c21d.zip 3.7MB
-
样本/App_Web_2m0c5qtj.dll.dll 62KB
-
样本/App_Web__admin.cshtml.639c3968.hdcdqyl3.dll.dll 16KB
-
样本/App_Web__custmerformpreview.cshtml.639c3968.w8bixs4r.dll.dll 16KB
-
样本/App_Web__form.cshtml.639c3968.vpoyvxxo.dll.dll 20KB
-
样本/App_Web__index.cshtml.639c3968.lwdowszg.dll.dll 17KB
-
样本/App_Web_a3cckjdh.dll.dll 6KB
-
样本/App_Web_awiukahf.dll.dll 174KB
-
样本/App_Web_c5534dod.dll.dll 7KB
-
样本/App_Web_civvcxbi.dll.dll 8KB
-
样本/App_Web_trt3t4lz.dll.dll 6KB
-
样本/App_global.asax.6ajlkhxh.dll.dll 4KB
-
样本/Aspose.Words.DLL.dll 5.7MB
-
样本/InfoEarth.Application.JCYJ.WebApi.dll.dll 1.8MB
-
样本/Learun.Application.SSOWebApi.dll.dll 144KB
-
样本/Learun.Application.WebAreas.dll.dll 4.4MB
-
样本/Learun.Util.dll.dll 386KB
-
样本/jna17855984959411834595.dll.dll 241KB
样本/App_Web_2m0c5qtj.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7cdf3953cd358277a1ab0ba8dfd4abead33d824e0209162f5d1346c9527afb2e
- MD5 7463aa59636d7e55e3357dbccc11a4f2
- SHA1 39403508b22ad735a1c045fe182dea2cfe0077c8
- SHA512 2b44b7db478999f8023d200503d076f16b84ccfe27295cbfb595410d1be5c01ff469b3687d9c3357f6e583fd78a771c8fd4c3e7caa3a529a37a1372ed5b5efa4
- SSDEEP 1536:asyZFWbQv0KnCVnjVjajqjYjdjyjPjo7xI+potk8I2ZBB:ajZFWbRx2eMpmbaxI+potk8IqBB
- TLSH T1DD53241337A90711E0BACF7959EE4D21472BA94E0874E5790DBC94CC8BB3B13849DFA6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
69806
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\root\79231b46\b45b5c0e\App_Web_2m0c5qtj.pdb
mscoree
_CorDllMain
Name
.text
Size
60KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
712B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
样本/App_Web__admin.cshtml.639c3968.hdcdqyl3.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a187e7dc2667cea9b748c5405ba9cc0fe6f8c33c1ec2ac4d89b982bb7b4d06cd
- MD5 66c0918f924e7c90e2bd99a358bbba24
- SHA1 0a8c32b8deed398266977b4cd0aa31deec9f9de2
- SHA512 e9959bece46e46827b37f4195fa5f4ccb877487207c6abb9da21b9841e611a0393d70e59bbb02e934f5b853f69ab10b70deedb059761c990691dbdd54a514cd9
- SSDEEP 192:OsTgkntUCg5chzUd9tFhwYxgyNM5R2Gnl9aCRGGmxspRWnaddX55CAx5Rx7xUJ:OkgknYyzUZFhw0gyNqRs9g/Te
- TLSH T19172FD0A37E80711F4B60F3D683196604B76FEA75D74F69E497C40DC1A62F04C8A9FAA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22222
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\root\79231b46\b45b5c0e\App_Web__admin.cshtml.639c3968.hdcdqyl3.pdb
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
样本/App_Web__custmerformpreview.cshtml.639c3968.w8bixs4r.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6816b921051a4dc98e537409bd6f0d3a6ab6ea5bb77721f9edaaf361a01c731f
- MD5 409952ab3f0fd39bed6fc8bdbb15b69b
- SHA1 105cbf7839c9b49e6af2e0fd4004d7a2f573fd30
- SHA512 62abe77565a65e6397c921d21dc2e2f4d3c388d0e3213595c94b6e2069c5b06572e411c893dda0f981d816d4db66cf993c34edae9fa6da17b96190169ead0b76
- SSDEEP 192:oEyPkWV/kkPT5mtVMrf6wYQHY+5BPAu9dxMHlTMXCRodNnAm551QT/NX01rj4i0+:oEyPzbr6w7HYnDR9wQiHiITT
- TLSH T17D72E90237E90714F0B61F3D697246204B7BBE669838E69D48BD50DD4BA3E04C869FB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22910
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\root\79231b46\b45b5c0e\App_Web__custmerformpreview.cshtml.639c3968.w8bixs4r.pdb
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
样本/App_Web__form.cshtml.639c3968.vpoyvxxo.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 28d91509ab2ea1d1cdb6ca0ce497f854b490d3536455ab29ce7e108c3b23a92a
- MD5 172cfd55e5704650a7c3e028bb418e33
- SHA1 e413e3a6355c7c9bf02b318100ce5ec9db410c4c
- SHA512 bd4e2a864e0b1063b27c1296f45514e48776b9341105027f7c76d36ecdd28f23c385b060eb2929fdaf99def6188aaf5280c6c3a90be9b8353d757bc872514648
- SSDEEP 384:p3PxYHQx7wrHYOquRKIwiHiEPQl9QDKtTm:p3yDqeKIwiHiEPQl9QDK8
- TLSH T1CF92A90227E50744F1B61F3C697642204B7BBE969C79E79D08BC509D4BB3A04C86AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
26158
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\root\79231b46\b45b5c0e\App_Web__form.cshtml.639c3968.vpoyvxxo.pdb
mscoree
_CorDllMain
Name
.text
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
样本/App_Web__index.cshtml.639c3968.lwdowszg.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a71e42f8a5f78b3ff25c5bda733512ccceaeb58b4c33b8764fd62f206038ae5f
- MD5 97c98bcc87a903d9709652197ba0171b
- SHA1 fa3d8787089905bb8e2095f31685c2365e230714
- SHA512 8f62fc6b39eb4ffedc2c93f49804c48bc8aa0ec1f6055539cc4b69a59db857a041dbcde4e4f86d51b26cedf8f271d4e2b3067b1f96cacf18a5589fbb9dbb285e
- SSDEEP 384:yOQgRlWyHiN9zUO11wogYveRlQiHiiTJ:yOQk4XnzU8ulQiHiy
- TLSH T19072EA0627E90704F1B21F3D687642204B3BBE569C38E69E487C54DD4BA3E048869FBB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23054
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\root\79231b46\b45b5c0e\App_Web__index.cshtml.639c3968.lwdowszg.pdb
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
样本/App_Web_a3cckjdh.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5584b460ac4c13479742becd1a24b44cc5d819b035a48ca0b30533ef1604769e
- MD5 8754522e9ad710b7bbc7f16c4f9a4800
- SHA1 f0181e848343838abcbd3043a7260ab82ac6cad7
- SHA512 918c7448fed19752f5d7501e1606fe4a1f0f18f123cf06e7003d4161c232c46a0f55f7648df3e5d1bfc0cce619c2eb340cb80578a348edddfb96dbe833add502
- SSDEEP 96:Bz63wSPmT4QE88w6YhkVsElt7fGkUL3TZ2zGC3oTHadx+dlMS:B+3DPmvhhmlt7f+TYzGC3oTHExW
- TLSH T1FAC1B50BBBD4C727D47B5734A5F2434167B4E90AA917DF6E5C8416087CA62044AB0BE2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
12238
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\root\79231b46\b45b5c0e\App_Web_a3cckjdh.pdb
mscoree
_CorDllMain
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
712B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
样本/App_Web_awiukahf.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5481dd2e097809af1b9d29c67540aafd34a68297d64db72251c673bcbb0dd06b
- MD5 686b5973b415580451cf9598345b7df8
- SHA1 4beeb565937d793b2ffa43acec30f148b306722f
- SHA512 167b58e47073e1617b30907434cf75a2ba353662b3ab12147751219ad20bb2f6172645085f5aceec3f6a76421d27b3b1949b7940b24b7948f7d873fd8a9b30eb
- SSDEEP 3072:9nD+ncjnVsLnDEN+HOeoiFQNqQntBw0GFkH/tfIRX++BSSK5iHMBhqBCej5euiXB:9nD+ncjnVsLnDEkHOeoiFQNqQ7f+9gsv
- TLSH T18404F20B3BAA0308F5B6DB6A5A770D30077BBD5A5438E658189CA48C9FF3B014456FE7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
184798
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\root\79231b46\b45b5c0e\App_Web_awiukahf.pdb
mscoree
_CorDllMain
Name
.text
Size
172KB
Virtual Size
172KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
712B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
样本/App_Web_c5534dod.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a17e7d25c455b0a0f47cdbeb57eb6a9f77a7aaadd996873ccfc8bb081be6a79a
- MD5 d2551430707f26c5fafa5cad039824a7
- SHA1 6cb1e87511f10c6c7f0896c452093d6df7182da8
- SHA512 76448e2adbca57d10b8309599b4c786bf28a135ce85968ae7fca0b864206dd5c57f625895086b945c8795455bc37a31f8f87566806c28940af3d0189b9f2291d
- SSDEEP 96:9n12YYZwx+vyZeI7wSMQOM/mVNceSmD+pJ6eUVCJBBmwrdxkdHAS:51wOx+vyZeI7wSHj+Ve/J6elJCwRx2
- TLSH T139F1F71B3BE8C363C47A4B7CA5728692533BF6059826D76F58CC805C5EC2714C1A2FB2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13758
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\root\79231b46\b45b5c0e\App_Web_c5534dod.pdb
mscoree
_CorDllMain
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
712B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
样本/App_Web_civvcxbi.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ef7a37f8ef6fbc6c8e82177d01dfc7b2af78b8ee19ed35ab486b8ffc604e2ce9
- MD5 25858edb7002a449e87c14ea3ff178f5
- SHA1 cd05418dc1143b14274d5b8ac79389c57ce107d1
- SHA512 c3cbebc417617aab46a851700fb9bd96aca9744449c2a1faa38e62b1dd25d913082a89520bc9707710a4d2a38a1eea4e0a1fc0ea539119fa1eefda17ec67fd55
- SSDEEP 192:m1tlA8A1LJlt/pWjGerSLRW5ZzC9YULS:23klIWLRWPzCmUe
- TLSH T1A4021A1F73D0C6BBDA5E17B64A6382115F70E9086E13FF2F4DD461299CC370449A1AB6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13358
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\root\79231b46\b45b5c0e\App_Web_civvcxbi.pdb
mscoree
_CorDllMain
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
712B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
样本/App_Web_trt3t4lz.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2f836d061d2920c6a9ab2b59d652cc1f1c886aed41bcc950a1202fb529056a7c
- MD5 c3076df6daa5c415205b1421e63e2655
- SHA1 a3e29906d22f68579ef5ad33f70e18f8e9896199
- SHA512 6264f5fe082ecb7d52b75b322b7038e93c47c23e0f4b78159425e973fbe623567fa3ac416596331aa2dec350b0e1e551c68cc2c20496f417ee3bbb4b87972f1b
- SSDEEP 96:0z63wSPmT4QE88w6YhkVsElt7FGkUL3TZ2zGM3oTHadx7dXFKSc:0+3DPmvhhmlt7F+TYzGM3oTHExT
- TLSH T1CDC1B41BBBD4C637D47B5734A5B2434167B5FA09A917DF2E9CC81108BCA72045AA0BE2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
12238
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\root\79231b46\b45b5c0e\App_Web_trt3t4lz.pdb
mscoree
_CorDllMain
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
712B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
样本/App_global.asax.6ajlkhxh.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ffaab9d97fa537b1aae7d277cccdf7067369703d1bdb0c7e195e48f6a85bda1a
- MD5 2ede84b5265497910cab3cb31056ef80
- SHA1 55ace281b225810b6330688488d92d85965f9532
- SHA512 6ab265cc2d6d7b5cad0adfc2bb3dbb8861a2edf87102ec396bdffe920752af73d0cd61008b4b16a9d9725f0e43a00c4e87f13975bf2c37a03e8c3144c71b75c2
- SSDEEP 48:6uTY0iiKa/NUafT0SOkNGMQuJ+Z/J8Hdx+xdF1ulAbfaDbgq:3AiK/WLa8dx4dOubfaDb
- TLSH T11A91B96717D88277E0B79730AAA343A217B4F518DE17677D49CC8218BC922148D31FB1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10366
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\root\79231b46\b45b5c0e\App_global.asax.6ajlkhxh.pdb
mscoree
_CorDllMain
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
744B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
样本/Aspose.Words.DLL
- SHA256 21487ee1794e96236e6f1010a065b6a158e2e2d8cde1f91476fae76e9d540627
- MD5 02c16f8897eeb080e4f55acec427199f
- SHA1 bf304189b32fdf5dcd7d151cc5cbae3edce19f5b
- SHA512 2a4303bf6056905a116d3294f96fa191c35365bcc56b0a6161796e9b439dfdb3113a2335db906744fe71d0357941c9eb1246d83c626d5ee29b603757f56cef66
- SSDEEP 49152:nr3gliCwDWDGkMZZ9i91jp2Afa5xqbFSEYu0n3KqyiU6Q:r3X1DWqvQ96G3sE7LT
- TLSH T182566B1037F94E6EE1AFB73668B11111A7F2F816E763DB8E096072691C32B509E047B7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8750270
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
8.3MB
Virtual Size
8.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
样本/InfoEarth.Application.JCYJ.WebApi.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6b07664e6c8a930dd4699d5f08cc667526f6d4a19d893bc2faba504da44cf68f
- MD5 eed27db330c4af6df1efa97bef624a02
- SHA1 0fd6f14a444301b29c05978affd2dbf68549319e
- SHA512 b294a299c20eb538dd6efa7510224cb7362cf02a49c54f34dd782aadea091d179598d62993869b286a8619daf947b2b77d0ae5e627012da49c4eb9e7f234e123
- SSDEEP 24576:P2xrVW7jTUClqxt1oVPG1yv14eKOh8n+b:P2xrVW7jTUCqxtCE1yv14eKOhp
- TLSH T13D953938BB949222C47F9378D9E54403A338A023E7A59F1D49D2D3E61D62346FF8267D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1901294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.8MB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
样本/Learun.Application.SSOWebApi.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 82272c541bdf0ad2d9b779fe96a2db45cf691bd3b30ec83e22c115e36aef3973
- MD5 b2b215f2b41b92eca589ee9eb52e1e5f
- SHA1 1d9b6b737e2b8c5610927a8690dc0e40c1c4be42
- SHA512 c35c9de3189ce1e8413a7c69a928d7062a1ad5fa35e82589f2c57447ccb8132936c76a01c06d7f0db11339356f50558d14ae15fe86357917312dc0aca0fe59a9
- SSDEEP 3072:ufoNlUe0f73YGMshK27Cbq/yuYjWZ21HQsZfYj:pA377Cq5YjWZqBZ
- TLSH T1DFE33A5426A4CE45C97E8ABAF034544513F2F307EDC2EB494FC9B8E92CA3341564DABB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
153034
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\code\InfoEarth_New\code\Learun.Application.SSOWebApi\obj\Debug\Learun.Application.SSOWebApi.pdb
mscoree
_CorDllMain
Name
.text
Size
141KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
样本/Learun.Application.WebAreas.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e14649a5a805f99f1947003ed909c5251232886e42d844a93aa00c036ad1b7d0
- MD5 833fc72761608a2f74eb6225756e2b02
- SHA1 9fbd97240ee413914741353a0bbc8acdc73a2749
- SHA512 2a7ac9ac8850cfb7338260cf8a7e5341fefae8c03c69e523e9b41e64b778e1249d086843dc2167395da79f033be8497ad45c3171d964ca21670a592256b89037
- SSDEEP 24576:u+doG0T0rc4B7ickGqZ/iDYp0JyB3tlTr+WtmZ/Zfdy6rW3UaIZTO8rliYY/5Gy+:HWTErR/iYY/5GyZ74
- TLSH T106264D1E7A650303E07AF7B9DA7A4D00EB67650F4430C9153EAC9E881FB7B14A651FCA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4666318
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\code\InfoEarth_New\code\Learun.Application.WebAreas\obj\Debug\Learun.Application.WebAreas.pdb
mscoree
_CorDllMain
Name
.text
Size
4.4MB
Virtual Size
4.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
样本/Learun.Util.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1faa34864e88bd60173ee39d8a076618be38a7634cc0e5d9ed0c2c6f9ff5214c
- MD5 ace88db2d46427e42f1d73933fa5d11f
- SHA1 97aea216aeea02eb7bc96e6a108cee8ebf11a1af
- SHA512 779c21b504d6a6b03bf081f2806e7c17a9f19050844435e0ccef88517fd92fda6f2eac24d2fb6a48950f9ddcae0dbbd4d4e159a6a1f7919eb92c294cea0daca2
- SSDEEP 12288:o/ENcgp8HsEYTwvMjPn8xYl7S724IdMhGv/pgyZNjNIQGRsWboQKRsWbo:5v/pg4NjNe
- TLSH T1AB848D28126C897DCABF2B399564741B4FB9F2366055EBFA17D0B0BB9DA3701CC08671
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
399662
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\code\InfoEarth_New\code\Learun.Framework.Module\Learun.Util\Learun.Util\obj\Debug\Learun.Util.pdb
mscoree
_CorDllMain
Name
.text
Size
384KB
Virtual Size
384KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
988B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
样本/jna17855984959411834595.dll
- IMPHASH a6991ecd6fdd0fbdc54db84defac64ec
- SHA256 df09119557efe5a5fc2237996b09c3da34fb60eb3ff0c6a5b2a35ec4212e0119
- MD5 3c016613eb59259f94e2add2b8d926c0
- SHA1 e26183f9919ed1daf5c1856c16f8a074bd9ef6dc
- SHA512 9e5a4240e276391c9480d0d96d953c12ebb315dc214383afb716091c090f157344901608d3d80f0ca3af80ff659d7d4dff6b21dff6c9512fa02a4cd5eb496ff6
- SSDEEP 6144:w0Rs7tttDwsZ2kXHdHoLmgvw6NARhpGRoy/nHsaTmy:w0RshtpIvbARb
- TLSH T198341807E7B648E5E8B7C13949136A12F9B178194320EBEB47858B035F66BE0DB3E750
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
103872
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
psapi
EnumProcessModules
kernel32
MultiByteToWideChar
GetShortPathNameW
GetLastError
SetLastError
GetCurrentProcess
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LocalFree
FormatMessageW
WideCharToMultiByte
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
Sleep
GetSystemInfo
VirtualAlloc
VirtualFree
VirtualQuery
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
InterlockedFlushSList
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
RaiseException
HeapFree
HeapAlloc
LCMapStringW
GetStdHandle
GetFileType
GetACP
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStringTypeW
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
SetStdHandle
HeapSize
HeapReAlloc
CloseHandle
SetFilePointerEx
WriteConsoleW
CreateFileW
JNI_OnLoad
JNI_OnUnload
Java_com_sun_jna_Native__1getDirectBufferPointer
Java_com_sun_jna_Native__1getPointer
Java_com_sun_jna_Native_close
Java_com_sun_jna_Native_createNativeCallback
Java_com_sun_jna_Native_ffi_1call
Java_com_sun_jna_Native_ffi_1free_1closure
Java_com_sun_jna_Native_ffi_1prep_1cif
Java_com_sun_jna_Native_ffi_1prep_1closure
Java_com_sun_jna_Native_findSymbol
Java_com_sun_jna_Native_free
Java_com_sun_jna_Native_freeNativeCallback
Java_com_sun_jna_Native_getAPIChecksum
Java_com_sun_jna_Native_getByte
Java_com_sun_jna_Native_getChar
Java_com_sun_jna_Native_getDirectByteBuffer__Lcom_sun_jna_Pointer_2JJJ
Java_com_sun_jna_Native_getDouble
Java_com_sun_jna_Native_getFloat
Java_com_sun_jna_Native_getInt
Java_com_sun_jna_Native_getLastError
Java_com_sun_jna_Native_getLong
Java_com_sun_jna_Native_getNativeVersion
Java_com_sun_jna_Native_getShort
Java_com_sun_jna_Native_getStringBytes
Java_com_sun_jna_Native_getWideString
Java_com_sun_jna_Native_getWindowHandle0
Java_com_sun_jna_Native_indexOf
Java_com_sun_jna_Native_initIDs
Java_com_sun_jna_Native_initialize_1ffi_1type
Java_com_sun_jna_Native_invokeDouble
Java_com_sun_jna_Native_invokeFloat
Java_com_sun_jna_Native_invokeInt
Java_com_sun_jna_Native_invokeLong
Java_com_sun_jna_Native_invokeObject
Java_com_sun_jna_Native_invokePointer
Java_com_sun_jna_Native_invokeStructure
Java_com_sun_jna_Native_invokeVoid
Java_com_sun_jna_Native_isProtected
Java_com_sun_jna_Native_malloc
Java_com_sun_jna_Native_open
Java_com_sun_jna_Native_read__Lcom_sun_jna_Pointer_2JJ_3BII
Java_com_sun_jna_Native_read__Lcom_sun_jna_Pointer_2JJ_3CII
Java_com_sun_jna_Native_read__Lcom_sun_jna_Pointer_2JJ_3DII
Java_com_sun_jna_Native_read__Lcom_sun_jna_Pointer_2JJ_3FII
Java_com_sun_jna_Native_read__Lcom_sun_jna_Pointer_2JJ_3III
Java_com_sun_jna_Native_read__Lcom_sun_jna_Pointer_2JJ_3JII
Java_com_sun_jna_Native_read__Lcom_sun_jna_Pointer_2JJ_3SII
Java_com_sun_jna_Native_registerMethod
Java_com_sun_jna_Native_setByte
Java_com_sun_jna_Native_setChar
Java_com_sun_jna_Native_setDetachState
Java_com_sun_jna_Native_setDouble
Java_com_sun_jna_Native_setFloat
Java_com_sun_jna_Native_setInt
Java_com_sun_jna_Native_setLastError
Java_com_sun_jna_Native_setLong
Java_com_sun_jna_Native_setMemory
Java_com_sun_jna_Native_setPointer
Java_com_sun_jna_Native_setProtected
Java_com_sun_jna_Native_setShort
Java_com_sun_jna_Native_setWideString
Java_com_sun_jna_Native_sizeof
Java_com_sun_jna_Native_unregister
Java_com_sun_jna_Native_write__Lcom_sun_jna_Pointer_2JJ_3BII
Java_com_sun_jna_Native_write__Lcom_sun_jna_Pointer_2JJ_3CII
Java_com_sun_jna_Native_write__Lcom_sun_jna_Pointer_2JJ_3DII
Java_com_sun_jna_Native_write__Lcom_sun_jna_Pointer_2JJ_3FII
Java_com_sun_jna_Native_write__Lcom_sun_jna_Pointer_2JJ_3III
Java_com_sun_jna_Native_write__Lcom_sun_jna_Pointer_2JJ_3JII
Java_com_sun_jna_Native_write__Lcom_sun_jna_Pointer_2JJ_3SII
Name
.text
Size
167KB
Virtual Size
166KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=241, version=40116,
count=120, id=243, version=40116,
count=13, id=242, version=40116,
count=7, id=259, version=24123,
count=20, id=261, version=24123,
count=17, id=260, version=24123,
count=5, id=203, version=65501,
count=94, id=1, productName=Unmarked objects,
count=1, id=259, productName=VS2015 UPD3 build 24210, version=24210,
count=6, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=2, productName=Unmarked objects (old),
count=1, id=256, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,