DumpDevice[.]rar | Triage

Sharing

General

Target

DumpDevice.rar
Size

23.3MB
MD5

c44086d8b24e261e8c4f6a36a48a5816
SHA1

211f8d8e686c33ffe7572e7b3721f3ae564eb440
SHA256

bd8f2c204dac8705ea4a7f5f3714b905d65508998b014775019a904cc24599bb
SHA512

8c3acd3163b4daeb1255152f4fc2d79e7684adf0c0bf1316c06d6fa8c08308c308575a70e20d422878feb7b5776b82a29343678692f7a7981171a120a7a25c0e
SSDEEP

393216:FM+l/Q8CXxVT0NrwFVRsj4zSK1jVTAFGkaFDQde/cxxYcoGIt2F2bgeV+uDVQUzU:FM+lPCXr0NJjsSDFGhIe/Kr82wAUXE57

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/DumpDevice.exe

Files

DumpDevice.rar
.rar
DumpDevice.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 23.3MB - Virtual size: 23.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ