Static task
static1
Behavioral task
behavioral1
Sample
c.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
c.exe
Resource
win10-20230703-en
Behavioral task
behavioral3
Sample
c.exe
Resource
win10v2004-20230703-en
General
-
Target
c.exe
-
Size
214KB
-
MD5
7007e1d06387b6ca204c98d49c7b07da
-
SHA1
5fb072d40016d80fed82631f20284b3672b2f965
-
SHA256
6abc7310211473a511a9e776b103c520d4a49ff7a400c222160af4ae0288a916
-
SHA512
ef3ca82efb87a0d395b2d0c8520a555eb7027bdb20cfa1932bb557a0323ded994f6bdf13bd020eaaa2b41a628edc4930c301884e79110ff5b3995b95bf5302ff
-
SSDEEP
6144:KZiai3mTU41O2oV1mD6ArKAenI3YNGDaXCF:KwZWp1OnV0+YKa3ApCF
Malware Config
Signatures
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule sample net_reactor -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c.exe
Files
-
c.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 212KB - Virtual size: 211KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ