Debug[.]rar | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Debug.rar
Size

128KB
MD5

9beaef4cfa7bf23865a6522bb7a91253
SHA1

a2933972a5eade67d40496611d8f8dc87e0aadf5
SHA256

0977f1aebcab0ec666dd86d72e71b9d17d09f05ab5412b7c13dc7193d7535f9e
SHA512

007056b7aa31bab51c09c8a01efc26a03ff86e5eb3894f49cafa0f7986d19a4a17027a82c6e20916d7fe9735364ed4dc29ff094c115ecec98f424c925fa231b0
SSDEEP

3072:MKJqlVbGbu+fH5c+T5jfg5u++hmxOGUUQ3tMEbnJa+3VLtLU2GQ9:MKJ2WH5c+VjfcujaOGUUsJaghU8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Debug/Dope.exe

Files

Debug.rar
.rar
Debug/Dope.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 250KB - Virtual size: 250KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Debug/Dope.exe.config
Debug/Dope.pdb