581362eb646979b687d1082101b9a498[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

581362eb646979b687d1082101b9a498.bin
Size

688KB
MD5

7d6f81e10c2b8c1b7c91cd67ddbf8d10
SHA1

c436db90e7cb4562491fc0b95d6bdc6cbae4be93
SHA256

2ad52abfde41d2c9d60c29f00995e6dcc4e96c0cdc7acd388e34d1d729f5f303
SHA512

f7cc85ea04cf03e9010e1e464f1807965bf4e243ee61174fec90e94aaac66d2ef55b29c4e519ed5445ac040ff3ae3710fb7bc4495cc527f01f7fff39e6b632d1
SSDEEP

12288:jPQcrcBcNO4EGx/g8lbwMXsHLmITP/iLnsde8yJT4IIBAC:EocBGxI8ls3HLmIinuYTNK

Score

7^/10

Malware Config

Signatures

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
static1/unpack001/31c9f1e8d86f03f7c5c4c3b309b8522a6cb5f98c1f98f661bf652b751e3a5d35.exe	net_reactor

Files

581362eb646979b687d1082101b9a498.bin
.zip

Password: infected
31c9f1e8d86f03f7c5c4c3b309b8522a6cb5f98c1f98f661bf652b751e3a5d35.exe
.exe windows x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 817KB - Virtual size: 816KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ