iplookup[.]rar | Triage

Sharing

Copy URL Twitter E-mail

General

Target

iplookup.rar
Size

1.3MB
MD5

eb8d78ce4b36541d176191388a53fe5f
SHA1

286030934f98dfba521a5f1c1c8be78f80d10255
SHA256

9860e48fa2de5dbff13523b7c910d9aa74a92173caef9d47f7a1c45195ad5e66
SHA512

0745b3e758a41025ebc19d6e059cdbe506a5abbbc62b6e916251c979ad99e2b2e5d4844dde46d58ce03919d670a6b8986ea95887789aac94d24c4d36fcf814f1
SSDEEP

24576:E/702REmHjGD3SZgxsCesB+z+EiZEym7jpa38r09+9Sx6Dy0:EQtmHjhCt+biKV1Y89o0

Score

7^/10

Malware Config

Signatures

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
static1/unpack001/iplookup.exe	net_reactor

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/iplookup.exe

Files

iplookup.rar
.rar
README.txt
iplookup.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ