Static task
static1
Behavioral task
behavioral1
Sample
275e8545b0fdb6c7acef45aa6e109685.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
275e8545b0fdb6c7acef45aa6e109685.dll
Resource
win10v2004-20231215-en
General
-
Target
275e8545b0fdb6c7acef45aa6e109685
-
Size
2.6MB
-
MD5
275e8545b0fdb6c7acef45aa6e109685
-
SHA1
5fcc96f9ecb5230c02c2fc2bc368d06352a944b1
-
SHA256
a9524141feab182697ee45965c0d91577eb32f4c9252160b1b50be3ed9b000e2
-
SHA512
7a781e466e03480e9c7a5abf6b9b42992c9478d1d8797be08272822266be00b7feeae6ed54c9b7a7058ecd39b7e89822744482c655e1af68217ed20ed392d747
-
SSDEEP
24576:q01GaJxve1E8pkCLLe/K43EnnnclQwIqJY0OjklWXQMFBRpm4L/59ah0USm3uwl2:q0ckvuV/59a6USdi9Ues6bV6bn
Malware Config
Signatures
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule sample net_reactor -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 275e8545b0fdb6c7acef45aa6e109685
Files
-
275e8545b0fdb6c7acef45aa6e109685.dll windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
.text Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 836B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ