Static task
static1
General
-
Target
6b50c49860e67ff6ae7d1d229cca779aa7e1ba3fa9a2cfea975d798bffdb6576
-
Size
640KB
-
MD5
41dda9e4d7134396306cbd01cbd60b30
-
SHA1
3870a024dd2ae5321bf10bb3a09fd7eec7ae628b
-
SHA256
6b50c49860e67ff6ae7d1d229cca779aa7e1ba3fa9a2cfea975d798bffdb6576
-
SHA512
78c10f2054c113f26431ae16afd16b0d2a83bce27564e14c8086907b57830b8ee7389eae3406c6af9387772bcfa79a12397b61d81b8949e4e0473f3637e5ede4
-
SSDEEP
6144:snyAwpL7RyBKGxf7mmP5KFwQNSfRJ5PaDXYPbDITIYdlIZElUUi1s1hASvRkA:snyAwpLNyBKGxaYr+cRvqXYzsTBOUiw
Malware Config
Signatures
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule sample net_reactor
Files
-
6b50c49860e67ff6ae7d1d229cca779aa7e1ba3fa9a2cfea975d798bffdb6576.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 476KB - Virtual size: 475KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 163KB - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ