Static task
static1
Behavioral task
behavioral1
Sample
050adcc51d26f9bf8ef365203c6567a2650fc287673ce81855b5e538f215f4ed.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
050adcc51d26f9bf8ef365203c6567a2650fc287673ce81855b5e538f215f4ed.exe
Resource
win10v2004-20231215-en
General
-
Target
050adcc51d26f9bf8ef365203c6567a2650fc287673ce81855b5e538f215f4ed
-
Size
1.2MB
-
MD5
3b69cdd74fe836c2a94f6ebda5e08d58
-
SHA1
8fad237cc23db77f6a96c75572d073e8df1e9131
-
SHA256
050adcc51d26f9bf8ef365203c6567a2650fc287673ce81855b5e538f215f4ed
-
SHA512
12d1710836fb39c0a817b99739a79bb75bdabc7b1633679ec4002948fec31ab9d6838f4881531643ecdd093635b8326e90951c3343a65c62e2ea343d40242407
-
SSDEEP
12288:KxTdfH+pVy4KfUSIB9UcWgsimLOfTWbctTB62m3py5+h2jQlIs9gt:+dfePSkvTWCB62m3I5AWJLt
Malware Config
Signatures
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule sample net_reactor -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 050adcc51d26f9bf8ef365203c6567a2650fc287673ce81855b5e538f215f4ed
Files
-
050adcc51d26f9bf8ef365203c6567a2650fc287673ce81855b5e538f215f4ed.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ