192_FACT[.]EXE[.]exe | Triage

Sharing

General

Target

192_FACT.EXE.exe
Size

683KB
MD5

71169a059f615b9522cd08d681f97650
SHA1

969af939812f3c7e577c544f5ee93bfe46652f4d
SHA256

c8c6e979a74449aa456da5161a158ea813d006ef6d7d87bec938591f56d6d041
SHA512

2ebd4d093f8704b588c01751978059f1b6d56485e62de30336e9c48ffbf01ee75a869ff8454e9080dc1ec524af755ddf173e99888fc5a9cc0f6afbbe1a6dc451
SSDEEP

12288:IoJGs6Il0T+MW/eL4QQs9R4wyuM6IbMIEQ8BsG77SQzNMbu3z1i:KeATO84QQOquM6IbMIEQ8BTPi

Score

7^/10

Malware Config

Signatures

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
sample	net_reactor

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
192_FACT.EXE.exe

Files

192_FACT.EXE.exe
.exe windows:4 windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 469KB - Virtual size: 468KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 213KB - Virtual size: 213KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ