Static task
static1
Behavioral task
behavioral1
Sample
f6387f29680370c85fe94c9de80d2842bd15fe05a17c7319728a6bf6989d09ee.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
f6387f29680370c85fe94c9de80d2842bd15fe05a17c7319728a6bf6989d09ee.exe
Resource
win10-20230220-en
General
-
Target
f6387f29680370c85fe94c9de80d2842bd15fe05a17c7319728a6bf6989d09ee
-
Size
1.4MB
-
MD5
0d2004d8caed44d00e7aa05228c141f1
-
SHA1
bf8441b41a93dbd2496ecf145a6f04bc7807d37e
-
SHA256
f6387f29680370c85fe94c9de80d2842bd15fe05a17c7319728a6bf6989d09ee
-
SHA512
09f8b34e2941128124fb46415d383ae52a044f12d53eec5d684c916d79a6f9b3cc6a37c78f6fac3b154300ef719f6885fb1945ce4cb903ca32fcd1698078980e
-
SSDEEP
12288:CN6CTNKbhY0S4FQj5iB0iRthUQI0Daf3i+NFz2jTGslFUr3FHWaVuxsI6MDW4EDs:CN9wqVXrU3K5T2BvNVD7VYrERqB
Malware Config
Signatures
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule sample net_reactor
Files
-
f6387f29680370c85fe94c9de80d2842bd15fe05a17c7319728a6bf6989d09ee.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 114KB - Virtual size: 113KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ