Static task
static1
Behavioral task
behavioral1
Sample
WinRAR.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
WinRAR.exe
Resource
win10v2004-20230621-en
General
-
Target
WinRAR.exe
-
Size
1.6MB
-
MD5
f52191191ac8950f15e38483ca8927af
-
SHA1
d051facee1918efca8df43fd8738d02b77c0bf57
-
SHA256
fedc35a1b93e0e18badb7900b6e4722a7656a65a75036e6a2e5010a393d648d7
-
SHA512
c7beda7c80423457dabf7da89dfc59a413a5e3dba246819c6019300f1aa69ee18fe50758958ff43d3fc0e51c5acaff0bb03e3cc4ff57a89241b23075196be36f
-
SSDEEP
24576:3uWSIdFbt6tQwe4gU2bAw0zR9vAfVNZ+ycVlCS0Of3m2Bd3X3N:31mXr2stzRRA3Z+jbC5Of3zH3N
Malware Config
Signatures
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule sample net_reactor -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource WinRAR.exe
Files
-
WinRAR.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 166KB - Virtual size: 166KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ