Static task
static1
General
-
Target
7f0a324642ace8823395697123fcbad81999dd23ab24bf6730f8847c72975dc2
-
Size
1.9MB
-
MD5
372a368db9c0036e58823d150f74f127
-
SHA1
3c70443a56f4102c4457196d3b7f0cf16862b362
-
SHA256
7f0a324642ace8823395697123fcbad81999dd23ab24bf6730f8847c72975dc2
-
SHA512
06fb90cfda12b9f40d8bffbf4279f2fbce54072d376c96108874fdd8fbf8ff9adbe418d45d02ffbf0e1e5258c4abca146cf311f2d03410697505934cdd1f7a91
-
SSDEEP
24576:ch87hb9JwYUwgxkOyPHlDuPuncUBWsEWq89oW2U7huCO53N16:ciXwYUwgCMPun5gQqY/B8CO53f
Malware Config
Signatures
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule sample net_reactor -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7f0a324642ace8823395697123fcbad81999dd23ab24bf6730f8847c72975dc2
Files
-
7f0a324642ace8823395697123fcbad81999dd23ab24bf6730f8847c72975dc2.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 182KB - Virtual size: 182KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ