Static task
static1
Behavioral task
behavioral1
Sample
6320306710f7b7a82e23be0017f45a308db281b3f25083e5acc1deecd017fccf.exe
Resource
win7-20231215-en
General
-
Target
6320306710f7b7a82e23be0017f45a308db281b3f25083e5acc1deecd017fccf
-
Size
3.8MB
-
MD5
1ac65c7c33b4ba694b19cfc6ef6a6702
-
SHA1
31343f7b8d1d07008c760550bad30d81a967519f
-
SHA256
6320306710f7b7a82e23be0017f45a308db281b3f25083e5acc1deecd017fccf
-
SHA512
7bd759fa5db98061c560ee3b227e1a2eed9884f35c71e4eab45e2ba3105ac7347b6683c4b29141ff893dff3f101aef457ed433e7bae703569aba5a21a1deee65
-
SSDEEP
49152:1u9rPUmIa6atsr36rr5qtvXGp8mih7NUfXUu4tEqNrqcqapPeDkwVzMemuYTwBTY:1HmIaaG/Mul2rq/aReDkizMeQUq
Malware Config
Signatures
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule sample net_reactor -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6320306710f7b7a82e23be0017f45a308db281b3f25083e5acc1deecd017fccf
Files
-
6320306710f7b7a82e23be0017f45a308db281b3f25083e5acc1deecd017fccf.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 3.6MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 186KB - Virtual size: 185KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ