» DMGExtractor.exe
Overview
Analysis
File Details
Programs (1)
Downloads (8)

DMGExtractor.exe

DMG Extractor

Reincubate Ltd

This is installed with DMG Extractor. The file has been seen being downloaded from doc-00-a8-docs.googleusercontent.com and multiple other hosts.

File name:

DMGExtractor.exe

Publisher:

Reincubate Ltd

Product:

DMG Extractor

Version:

1.1.1.1

MD5:

18ad5bcb035253b4e2cb58ec2acf6887

SHA-1:

2d1d0dc908bf6391a0f16a7ade7222e6ffbbb522

SHA-256:

d0e731d68f274c23a2dd6ac4e370e94c350126755ca6b8f0ce0b73c9d810a47c

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

4/23/2024 5:32:07 PM UTC (today)

File size:

746 KB (763,904 bytes)

Product version:

1.1.1.1

Original file name:

DMGExtractor.exe

File type:

Executable application (Win32 EXE)

Language:

Language Neutral

Common path:

C:\Program Files\reincubate\dmgextractor\dmgextractor.exe

File PE Metadata

Compilation timestamp:

12/30/2012 7:21:18 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

8.0

.NET CLR dependent:

Yes

CTPH (ssdeep):

12288:Lje0Me0ie0Xev35ZdEegFj7YfyDznFye0:/e0Me0ie0q5ZUZJDxye0

Entry address:

0xA5AEE

Entry point:

FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00... 
[+]

Entropy:

6.6409

Developed / compiled with:

Microsoft Visual C# / Basic .NET

Code size:

655 KB (670,720 bytes)

The file DMGExtractor.exe has been discovered within the following program.

DMG Extractor by Reincubate Ltd

About 5% of users remove it

The file DMGExtractor.exe has been seen being distributed by the following 8 URLs.

https://doc-00-a8-docs.googleusercontent.com/docs/securesc/unqd0eodqtps2bpdfliusmul7ken593k/fhk6ab33qjgvuhghmb5ilfn69b8b8qs2/1371002400000/09264405521275681385/.../0B4NEC8x7piLPbzFZc3pfWXdSLVE?e=download&h=16653014193614665626&nonce=mssob878enu7o&user=10273341803860175846&hash=9t824mpjedh91sgsbj4aqn29mepdpd6r

https://docs.google.com/nonceSigner?nonce=mssob878enu7o&continue=https://doc-00-a8-docs.googleusercontent.com/docs/securesc/unqd0eodqtps2bpdfliusmul7ken593k/fhk6ab33qjgvuhghmb5ilfn69b8b8qs2/1371002400000/09264405521275681385/.../0B4NEC8x7piLPbzFZc3pfWXdSLVE?e=download&h=16653014193614665626&hash=07kc1qpvbsb4bcibqsrug143lgdvtnf1

https://docs.google.com/uc?id=0B4NEC8x7piLPbzFZc3pfWXdSLVE&export=download&pli=1

https://docs.google.com/uc?authuser=0&id=0B4NEC8x7piLPbzFZc3pfWXdSLVE&export=download&pli=1&auth=DQAAAI8AAAB-Hu2THnjd7GUnQL9Lf38jNNuxE5z-WZPIrACGYb01T1kRRO5JrbIxPgp8xC1Rtn3pKZR8hn_V84KW063Xm3KM-tKmfUj6rI3fuRpGRgwXm-fFzlPP9nBM7r_9l5EJxazdns9XPToF5cH2cosVq-lM5ccl_AjCXzDuC8-KBCfTpnTyDZK0wbmWj_bcvcApXlw

https://accounts.google.com/ServiceLogin?service=writely&passive=1209600&continue=https://.../uc?authuser=0&id=0B4NEC8x7piLPbzFZc3pfWXdSLVE&export=download&followup=https://.../uc?authuser=0&id=0B4NEC8x7piLPbzFZc3pfWXdSLVE&export=download&ltmpl=homepage&authuser=0

https://www.google.com/accounts/ServiceLogin?service=writely&passive=1209600&continue=https://.../uc?authuser=0&id=0B4NEC8x7piLPbzFZc3pfWXdSLVE&export=download&followup=https://.../uc?authuser=0&id=0B4NEC8x7piLPbzFZc3pfWXdSLVE&export=download&ltmpl=homepage&authuser=0

https://docs.google.com/uc?authuser=0&id=0B4NEC8x7piLPbzFZc3pfWXdSLVE&export=download

Scan DMGExtractor.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.