vbc[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

vbc.exe
Size

360KB
MD5

4613d35a077f6a25f1c3736a526d9813
SHA1

baf36b7ee3de54362b34c9b93534166906dda074
SHA256

9f7d6ebd7e93a4b5d3774bd0c46e183447133125c58d347fa68e029d863ad717
SHA512

6221890a831b0fdb96acc867de44b876192ab996918f526a9429660f435daf125a7840b13f496e29b25f5ad6ecccdc55cd7e81240057e0e96402eaaec77c3bc5
SSDEEP

6144:3Hs/PNecmgZUmMs5bjqGQNEcaVkEAlnnzfM4nUwzsFJyXbNy0O12udoEUA:3HYEcmgss5SjGLVkPlzfM4uJObNwldE

Score

7^/10

Malware Config

Signatures

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
sample	net_reactor

Files

vbc.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 352KB - Virtual size: 352KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ