Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20231215-en
Target
file.exe
Size
4.6MB
MD5
17a553248fc52f518f75bbe878ea1aa9
SHA1
dd9a6679f9fc6d580a49a2288eabb0b7e91f8717
SHA256
a9c22a3fe2856a1c2afeccaad1188e6e4fab5990b800bbe6d02212909dea8f2e
SHA512
44640567bb4c6219d5058adcf8fe678b066b11c0bf44a6f32c259c95bed160c6f11cf879e2b915390cea1f394f4d60c3f3e98ff37776446591da8cad25b9af70
SSDEEP
98304:64sQLWqRi8tmrI3gNGHjcX5uN13mEzquag:6H+WqRi88sEGHAX5uaEzP
resource | yara_rule |
---|---|
sample | family_zgrat_v1 |
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource | yara_rule |
---|---|
sample | net_reactor |
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
_CorExeMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ