Behavioral task
behavioral1
Sample
Nord VPN crack.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Nord VPN crack.exe
Resource
win10v2004-20230220-en
General
-
Target
Nord VPN crack.exe
-
Size
14.9MB
-
MD5
f77c18efeaa8e0601e6633a9ebc056fb
-
SHA1
8d5e036ede85057e2ba4bdb8cc71709f761fc778
-
SHA256
7f46a57ab126837b19543bc5f7c00c1aa31f270bbd963cc53b23a1a0d0d82730
-
SHA512
0a9550f3988abdc072f1bd542f67ee074bc9881e6254335d833a9124208233d8be5734fab7346e137809810a3f421d5007c1d647e9db272f58dcd543b9e63c24
-
SSDEEP
196608:xkx9RHwbq+9QJGC018ev0Oo0wLzifJfaaSBgkONwDG/EHQ0wPm28lJ:mxQdpmev0r0DfVYgkwp6QnPeJ
Malware Config
Signatures
-
Redline family
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule sample net_reactor
Files
-
Nord VPN crack.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 14.9MB - Virtual size: 14.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ