Static task
static1
General
-
Target
SantaBox.exe
-
Size
198KB
-
MD5
44e9193009a6cd1e437a36c9669b505b
-
SHA1
ca843bff19631a5ac0af988e5d53e7220cf9fe5e
-
SHA256
5533d026c4258a585a7d4c36a48c5417cb4e40814660f13a22deb1d06ef20c32
-
SHA512
a6a6acf6744c0c1378cf9d2c79cba049ef83c38851e5169eb5638fd9c2984e6ea0b4232c3c9106c027034fc496382ebb0132fb368078371c0ae89b51e290cc90
-
SSDEEP
3072:LI3HAc7qfuIIWRPx3CRb9lP8C6hpzATCrNzOKLYbBgoQsCGmiEGnplFHDQNEYBM:E3gc7q2E3eP16nTpzOK8aoyQzsNtBM
Malware Config
Signatures
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule sample net_reactor -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SantaBox.exe
Files
-
SantaBox.exe.exe windows x86
Password: secplayground
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 195KB - Virtual size: 195KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ