DevpackManager[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

DevpackManager.exe
Size

2.5MB
MD5

c3ea41f623c7387c3ef47d0ebc1b7546
SHA1

167252026279b7040e16afebcd2e9cb27ab7a3a6
SHA256

b6f3e3cf5f16398a0f20c80d263052995029c1b799bb29817ff1bf39a6aecfcc
SHA512

7fa2ddd279625cda05bf559daca5de291e55c70d2e1e054145b182c93f6c19e63984ed5a658f1de0ab0d90004990354f12afe8f0430c31b56f1ff37a01a4284e
SSDEEP

49152:WDPk3syj5I2V/RKbdDDi74012EzOkqXfd+/9ACvWEvRBA2FCccvnpXSVfQ3H:WDPk3syj5P5Khfh01MkqXf0Fh+Ev7Z8o

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DevpackManager.exe

Files

DevpackManager.exe
.exe windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\golda\source\repos\WRat-Discord\WRat-Discord\obj\Debug\WRat-Discord.pdb

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ