Static task
static1
Behavioral task
behavioral1
Sample
bd7d28de5cf2ed91834d6067a4677c958f688ce897451e513b8bcc031ac1fc6c.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
bd7d28de5cf2ed91834d6067a4677c958f688ce897451e513b8bcc031ac1fc6c.exe
Resource
win10v2004-20230221-en
General
-
Target
bd7d28de5cf2ed91834d6067a4677c958f688ce897451e513b8bcc031ac1fc6c
-
Size
761KB
-
MD5
6899be046e9289aa104d2b7f6e200583
-
SHA1
c3e97284e294ccd737ba040f289853ef2add2019
-
SHA256
bd7d28de5cf2ed91834d6067a4677c958f688ce897451e513b8bcc031ac1fc6c
-
SHA512
08364ec380f46e1b494a0e0f93064e26e50b8a4b6fee7977c0b29f981acbb1cdf8053f08e55f8d4634f3a712d5f6bc2a5e15058076c062abd4104fb0bd8237b8
-
SSDEEP
12288:bFDf8mmwljWBqa+tOAgZY30/O0DklktYh5ApH6StKBU0T9b8s02RdoXx1QYHM4E:KwljW3+tDgZY30/O0DCFPK1t/0E2rkxj
Malware Config
Signatures
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule sample net_reactor
Files
-
bd7d28de5cf2ed91834d6067a4677c958f688ce897451e513b8bcc031ac1fc6c.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 759KB - Virtual size: 758KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ