Static task
static1
Behavioral task
behavioral1
Sample
spoof.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
spoof.exe
Resource
win10v2004-20230220-en
General
-
Target
spoof.exe
-
Size
568KB
-
MD5
9f644bb770da1f86b1bb04e1ac8d2621
-
SHA1
85be18c700bf2488f070a6b3d7dda7adc05b32e0
-
SHA256
868be91cc3f077f5bd22360498271aab974d7affe544dddbc6829d66760d12d8
-
SHA512
ae64dc2f0c16c2bc94bf404c4600ad0133cba3c28855474cf14ca7762dfc51b865f0923127f78979e1e75b46f3cc9c6c17a53824afe94f3ee7e04eee5929d593
-
SSDEEP
6144:VZMN3sm2eElsdMXpiZDJ2wbJJKLZq/uHtI3Ms5IBzNoBq/rHMoajatM2jw:zuqeElsdMX88gJK9SctS6uqTraGnc
Malware Config
Signatures
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule sample net_reactor -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource spoof.exe
Files
-
spoof.exe.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 563KB - Virtual size: 563KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ