Static task
static1
Behavioral task
behavioral1
Sample
2.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2.exe
Resource
win10v2004-20231215-en
General
-
Target
2.7z
-
Size
301KB
-
MD5
0aba51a20738cdfad05673a934e2055a
-
SHA1
a49d4d2835708c293607e1f4253fa6f59d26d1f8
-
SHA256
2389982cb4147f8a31d60fbecf0e2faffbaa96523ea7a33e60f84ec077ecbeb0
-
SHA512
9df78687b61f8c5d7d5b2a20f919868f4b434eea79f7d0ae8aa8f462bcec4216cf41e965fa874495358ebfbdcf87b86ecf14fc8444655f654e19bba87305402a
-
SSDEEP
6144:8DtdesAfEWrJhzNe4kpK331YpO7S0+AHwohmPKHItQ3enVc0Hm3Bi:8qfE2fkptO7SmnQPvBVTG3g
Malware Config
Signatures
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule static1/unpack001/2.exe net_reactor -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/2.exe
Files
-
2.7z.7z
Password: LЧVЮ=7vЛ+ыПЫнiбф4!ФWщЮ;NгЯЭБm=ы[;_U9WЩбW#u&j&m?-++жЦhq№fЖтjы%ч$ж}ю4мUя4бЫ;Г:Цвё~Ш9ЁЖ{Гj4VfFh_j;Ёvн9#
-
2.exe.exe windows:4 windows x86 arch:x86
Password: LЧVЮ=7vЛ+ыПЫнiбф4!ФWщЮ;NгЯЭБm=ы[;_U9WЩбW#u&j&m?-++жЦhq№fЖтjы%ч$ж}ю4мUя4бЫ;Г:Цвё~Ш9ЁЖ{Гj4VfFh_j;Ёvн9#
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 389KB - Virtual size: 389KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ