Static task
static1
Behavioral task
behavioral1
Sample
b1858aeacbb480aa29f845f3f2212356aca8950439936c1f0e9229a29c0ac87c.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
b1858aeacbb480aa29f845f3f2212356aca8950439936c1f0e9229a29c0ac87c.exe
Resource
win10v2004-20231127-en
General
-
Target
b1858aeacbb480aa29f845f3f2212356aca8950439936c1f0e9229a29c0ac87c
-
Size
546KB
-
MD5
eb9163286ae82ede1192c555b20e24aa
-
SHA1
9b6ee862f3466d02b4b35c9ed18e5d0836de3d94
-
SHA256
b1858aeacbb480aa29f845f3f2212356aca8950439936c1f0e9229a29c0ac87c
-
SHA512
d103521a019ad48fce26e26f10d797aedb5159ae56038d5c2b2c6eb49b17650c7bb75a06e99447dbe4703e47b5fcd5181adb67913d61efb928002e51c781f07a
-
SSDEEP
12288:3EnwGYo5ukK9683iGi+cqFBHVHwSgW7zUgZ73VA6h7SlXud+i64RTR2EEJp55HRV:oV5ukK9683iGi+cqFBHVHwSgW7zUgZ7m
Malware Config
Signatures
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule sample net_reactor -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b1858aeacbb480aa29f845f3f2212356aca8950439936c1f0e9229a29c0ac87c
Files
-
b1858aeacbb480aa29f845f3f2212356aca8950439936c1f0e9229a29c0ac87c.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 543KB - Virtual size: 543KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE