Static task
static1
Behavioral task
behavioral1
Sample
7dfa8092c8f3c69e14ffcbfb03e143adfe2d1806d3155296cdbb3ae5f6dbd6ca.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
7dfa8092c8f3c69e14ffcbfb03e143adfe2d1806d3155296cdbb3ae5f6dbd6ca.exe
Resource
win10v2004-20221111-en
General
-
Target
7dfa8092c8f3c69e14ffcbfb03e143adfe2d1806d3155296cdbb3ae5f6dbd6ca
-
Size
205KB
-
MD5
0aaf93133a8163670fe9646299406bd0
-
SHA1
6f135d19894bce53c8455e51ae17950ee45ced6c
-
SHA256
7dfa8092c8f3c69e14ffcbfb03e143adfe2d1806d3155296cdbb3ae5f6dbd6ca
-
SHA512
4340fbcc020e5f85e16c2f0e604a48a12e1a50449e72fdb21f7764e8cfae300fe58eccf6af99358feb6cf52ac2a80d4c48e0413f36ab65676c20da05f4e0e8de
-
SSDEEP
3072:ViyIyBE4X5zJoGUDp9UDpa2aRZcReUmKAxKC2xFnEHg:ViyIyBE4XhJ5UF9UE2aIRNmGxM
Malware Config
Signatures
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule sample net_reactor
Files
-
7dfa8092c8f3c69e14ffcbfb03e143adfe2d1806d3155296cdbb3ae5f6dbd6ca.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 146KB - Virtual size: 146KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sdata Size: 512B - Virtual size: 177B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 580B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 56KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE