Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Static task
static1
Behavioral task
behavioral1
Sample
out.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
out.exe
Resource
win10-20230703-en
Behavioral task
behavioral3
Sample
out.exe
Resource
win10v2004-20230703-en
Target
out.exe
Size
287KB
MD5
d1b2df3069830bd012e2582fb1fa9a84
SHA1
8ca8df33ab67e7e6ab5e2493402ab12210d2585e
SHA256
f8e70e6322e7267a664bacd61a273aa04fa4f54728c5d1fa72a06aab9b93a944
SHA512
f4efa16e7623d2915d9a68fb7aa9207289ae925c529a20767d75aa2fae7e22cf88314fbe7bce42fddcdcde359f24fd772433188a2683d343da39ed02d211cae4
SSDEEP
6144:dD/PqIkmYatb4jOYIX9Tgjc1eL5z4WP3Yj:Wm/tiOYIG4w4mi
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource | yara_rule |
---|---|
sample | net_reactor |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
_CorExeMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ