DevWatcher[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

DevWatcher.exe
Size

610KB
MD5

f7f91b6bd4936e4d04d7983bcb3f3fc6
SHA1

d684daec10a8f88418c795adee892fd487dc520d
SHA256

7068e989287a23699c03d955d51c799511fca19a1bc4c9a093515476a6f83fb5
SHA512

bc6af8efa92e17c73b4adae403d5e5d4ba90ad5676f10236cf8563c76650815feefc0a3d7603a2262a15ea1579fd9f1d0bfd951c7b6b544072be10fad00579dd
SSDEEP

6144:5Yb2BydHpBuEQ+dVydHpBuEQ+dsydLpBu45+m:5LBydgaVydgasydR5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DevWatcher.exe

Files

DevWatcher.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\jsterckx\OneDrive - Telenet\Local\Projects\jens\DevWatcher\DevWatcherGUI\obj\Debug\DevWatcher.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 416KB - Virtual size: 415KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 193KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ