Static task
static1
Behavioral task
behavioral1
Sample
PCELK.bin.exe
Resource
win7-20230712-en
General
-
Target
PCELK.bin.exe
-
Size
3.1MB
-
MD5
b0cb207a394bc5a5a6a987a56ec7d5ad
-
SHA1
02937cec5f8f82427b033d31225aa746dd9750c4
-
SHA256
fc29f52e495390630ccda0c1071af6a811eeae68ae7d7cee5de58bdc02f00b61
-
SHA512
c363b7bd27fb87460e6fb656dec74ca8cde7febc1e43e86fe56a702edbc74362b701856580e43891d50250a835638c396cf329e92c503408cc397da25be1b679
-
SSDEEP
49152:vLk//TBWXW0BIJ9GyRiwbMws9DnxsqXG02M1KY7Z4sXRuk:vLU/uWUIjGyVMwiLCaZVYk
Malware Config
Signatures
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule sample net_reactor
Files
-
PCELK.bin.exe.exe windows x64
Code Sign
19:c7:e0:9e:14:25:d8:b8:48:5d:a7:43:8f:fd:57:0cCertificate
IssuerCN=Hewlett-Packard CompanyNot Before16-07-2023 17:53Not After17-07-2033 17:53SubjectCN=Hewlett-Packard Company39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before03-05-2023 00:00Not After02-08-2034 23:59SubjectCN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02-05-2019 00:00Not After18-01-2038 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ec:5c:f9:5a:2d:aa:16:b2:88:f6:81:2a:14:33:a7:0a:d1:d6:ff:e4:d8:0e:ad:4b:d4:32:1b:d4:16:51:56:9eSigner
Actual PE Digestec:5c:f9:5a:2d:aa:16:b2:88:f6:81:2a:14:33:a7:0a:d1:d6:ff:e4:d8:0e:ad:4b:d4:32:1b:d4:16:51:56:9eDigest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 138KB - Virtual size: 138KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ