Static task
static1
Behavioral task
behavioral1
Sample
RexonFREE.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
RexonFREE.dll
Resource
win10v2004-20231215-en
General
-
Target
RexonFREE.dll
-
Size
2.6MB
-
MD5
a961c16731e23592bd301e671117c2fa
-
SHA1
adefc35da1f26c8e965b71d8f3ebf636d25738d6
-
SHA256
2dbcb186b16e9dd49378c60d80a39279f624bdd73a616bde27ab8f033e09a7b6
-
SHA512
760d58e029ebce257fc68c5c3451bfdf301b00c702c20726dffaba69708ca50297267172c5542a564c427cdaac9cdea837116468d982de3d2a9047fd09c394cf
-
SSDEEP
49152:+0Psp4w1P4bHsS7gY6rJJ3buign2SqYJIGxj9UY+Bx0ZGTHBpK43NUmOCH8kSMBt:pW4o4/iHGQYA7LTIIGuvzklp
Malware Config
Signatures
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule sample net_reactor -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource RexonFREE.dll
Files
-
RexonFREE.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 840B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ