Static task
static1
Behavioral task
behavioral1
Sample
ee3543a5ecffba2f314da24c9f4297d8b71116fc40ae1853741635e150c8eaf1.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
ee3543a5ecffba2f314da24c9f4297d8b71116fc40ae1853741635e150c8eaf1.exe
Resource
win10v2004-20231020-en
General
-
Target
ee3543a5ecffba2f314da24c9f4297d8b71116fc40ae1853741635e150c8eaf1
-
Size
508KB
-
MD5
c2bdff6d31f530df6794cf93c41e7453
-
SHA1
4e73327d4575080b65c611c6b336828ab133161a
-
SHA256
ee3543a5ecffba2f314da24c9f4297d8b71116fc40ae1853741635e150c8eaf1
-
SHA512
feb96a1d7eb83a6e458cd3643d568f54a1bbd6cb5ad1e8a4f872dc1d6657207a762cdeee67d9d43d5871bf1985d341b0e821b8190184844970b8cadd256d39a5
-
SSDEEP
6144:evw4fO1M8bkwhd5XkWcLKylGwjaUtuEl8zxMMQsbDR1Q/81m+e9axZcZYy7o4Qnd:e7fO6k9IGoaUtmVQsb1mX5ZYy7Ja
Malware Config
Signatures
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule sample net_reactor -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ee3543a5ecffba2f314da24c9f4297d8b71116fc40ae1853741635e150c8eaf1
Files
-
ee3543a5ecffba2f314da24c9f4297d8b71116fc40ae1853741635e150c8eaf1.exe windows:4 windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 440KB - Virtual size: 439KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ