Static task
static1
Behavioral task
behavioral1
Sample
753bb04a95c1536bac1959291598d2cb603b25b8684f55056363c0e41bce1c53.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
753bb04a95c1536bac1959291598d2cb603b25b8684f55056363c0e41bce1c53.exe
Resource
win10v2004-20231023-en
General
-
Target
753bb04a95c1536bac1959291598d2cb603b25b8684f55056363c0e41bce1c53
-
Size
561KB
-
MD5
ab608acdf9f342024a15c1e14790ed72
-
SHA1
02e8e8196d48b43e48d99f9343754baeb03da7d1
-
SHA256
753bb04a95c1536bac1959291598d2cb603b25b8684f55056363c0e41bce1c53
-
SHA512
ed4522f8ebb80fe3c0d6537b52999de947713ab1da8300ea5188512c66a2f6b2c50f2dbdc2bc81b965f1509c03fc8e3f6fed28fac5ba973665efe061b13ba425
-
SSDEEP
12288:LRDHXbmG2fEqkRcGFL5FqZnve9Qh8Lq24iU3K:hroGFL5EHhr
Malware Config
Signatures
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule sample net_reactor -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 753bb04a95c1536bac1959291598d2cb603b25b8684f55056363c0e41bce1c53
Files
-
753bb04a95c1536bac1959291598d2cb603b25b8684f55056363c0e41bce1c53.exe windows:4 windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 553KB - Virtual size: 553KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ