Static task
static1
General
-
Target
RexonFREE.dll
-
Size
4.3MB
-
MD5
2a18f5481172769b3324e0ed08e7b65c
-
SHA1
c94f9f8b632d95b0fc268a6bab57b750c3517a72
-
SHA256
dff11fdd7bc6759c38b4e14e40491d504ccfe726dbd95a852a01be0d0c1c1c6a
-
SHA512
d3072a52c72d3a574155986cd6defe68f1786a5885a41c9ce3a65c1255c6adcf293f55ecde24c2914910ae8431f053f7eb240ba32346de3140b4218fd0e205c4
-
SSDEEP
98304:8vu/otiLqY2X6Uy07P4HXJKN5/neeNmo2Gt2cxl3OV:8v7tiLqY2X3y0b4HXJKN5/nhNmo2Gt2k
Malware Config
Signatures
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule sample net_reactor -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource RexonFREE.dll
Files
-
RexonFREE.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 4.3MB - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 784B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ