Photo_GoogleMaps_myphoto-7-0-56-1-01-photo_my-11[.]scr[.]exe | Triage

Sharing

General

Target

Photo_GoogleMaps_myphoto-7-0-56-1-01-photo_my-11.scr.exe
Size

14.0MB
MD5

a4ab9547bec4c8fe0f187a8bedd3f8b5
SHA1

fb0f71ba6132b0cc7b3844c07b9dbc5f8bc578b9
SHA256

19ef515572e854be0638523790c2f83ab245178b3c27746dc9f9b04c1c1319b2
SHA512

0686e9cca60ff256c6da52c681268f7342c70f6df1d62c03807880643117f7dfaa670fdbe1eaa7e54b387e93bb05db81b65bd3a95e6ddd8104a9b4413732a922
SSDEEP

98304:bIr63hrtH0wcQkh2hidp6okCrsl1O1C8e8ZTVQJaeyF91KZVqg81ElLbf:4avcQkh2wdXkHO15LVZ7909V

Score

7^/10

Malware Config

Signatures

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
sample	net_reactor

Files

Photo_GoogleMaps_myphoto-7-0-56-1-01-photo_my-11.scr.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 13.9MB - Virtual size: 13.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ