Static task
static1
Behavioral task
behavioral1
Sample
46991d308325ff38b6e6c6af10ba013b6b3bd8470c44fd54b5c6111aec230449.exe
Resource
win7-20231215-en
General
-
Target
46991d308325ff38b6e6c6af10ba013b6b3bd8470c44fd54b5c6111aec230449
-
Size
5.1MB
-
MD5
9689213c547ca0fc6260d3084be3a4a4
-
SHA1
d0fffd8d2091d76a583b291955643c899395d821
-
SHA256
46991d308325ff38b6e6c6af10ba013b6b3bd8470c44fd54b5c6111aec230449
-
SHA512
2cd364799cc47aa09c0335f42ba2d648fc5679423b555de1d00e8416abb622ad70227d6f027fa2f343397e7def33a787e05fe53a07d16d142c1449a24e22b661
-
SSDEEP
98304:RRYbmWO3bhzCWKlV4ulUU1G/Mul2rq/aReDkizMeQUt:zYCWO3bhzCWKlV43/Mul2rVe4iwVU
Malware Config
Signatures
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule sample net_reactor -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 46991d308325ff38b6e6c6af10ba013b6b3bd8470c44fd54b5c6111aec230449
Files
-
46991d308325ff38b6e6c6af10ba013b6b3bd8470c44fd54b5c6111aec230449.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 4.9MB - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 219KB - Virtual size: 219KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ