207fb4aeffd47811049fe5c6366f09f70b859c6987883dcd9244a915af91a342

Sharing

Copy URL

Twitter E-mail

General

Target

207fb4aeffd47811049fe5c6366f09f70b859c6987883dcd9244a915af91a342
Size

4.4MB
MD5

4a8099ca44ad78fa5414bab4f54ba030
SHA1

ad1e9ee328d7eb870ebdaf9cf592a183f838f459
SHA256

207fb4aeffd47811049fe5c6366f09f70b859c6987883dcd9244a915af91a342
SHA512

b1f905210d372c8352c07ea6c27bd71f12f7ee3a1e40375925bc6cb295b08d07d5bd9407e4da6e7d303a0951fb19e060a652951bfdf67f1151f19720e8698d03
SSDEEP

49152:0fhvX07qcsIUv5z95W+diSQJAoCWFf4z6X5MS/tl3odglPCpgVS84OH:+hc7qcvWzE4OX53C+V5r

Score

7^/10

Malware Config

Signatures

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
sample	net_reactor

Files

207fb4aeffd47811049fe5c6366f09f70b859c6987883dcd9244a915af91a342
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

17:cc:e5:9f:c4:36:43:99:44:36:8f:49:40:f4:b3:e4
Certificate

Issuer

CN=2th Generation Intel® Core™ i5-1235U

Not Before

19-06-2024 23:25

Not After

20-06-2034 23:25

Subject

CN=2th Generation Intel® Core™ i5-1235U

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ee:02:43:33:cc:d6:10:09:93:ef:fe:6e:46:73:8d:f9:80:16:20:b7:fc:15:a7:04:3c:b2:ad:16:f3:7b:26:77
Signer

Actual PE Digest

ee:02:43:33:cc:d6:10:09:93:ef:fe:6e:46:73:8d:f9:80:16:20:b7:fc:15:a7:04:3c:b2:ad:16:f3:7b:26:77

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

defaultsoft12.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 4.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 137KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

17:cc:e5:9f:c4:36:43:99:44:36:8f:49:40:f4:b3:e4Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

ee:02:43:33:cc:d6:10:09:93:ef:fe:6e:46:73:8d:f9:80:16:20:b7:fc:15:a7:04:3c:b2:ad:16:f3:7b:26:77Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 4.2MB - Virtual size: 4.2MB

.rsrc Size: 137KB - Virtual size: 136KB

.reloc Size: 512B - Virtual size: 12B

17:cc:e5:9f:c4:36:43:99:44:36:8f:49:40:f4:b3:e4
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

ee:02:43:33:cc:d6:10:09:93:ef:fe:6e:46:73:8d:f9:80:16:20:b7:fc:15:a7:04:3c:b2:ad:16:f3:7b:26:77
Signer

.text
Size: 4.2MB - Virtual size: 4.2MB

.rsrc
Size: 137KB - Virtual size: 136KB

.reloc
Size: 512B - Virtual size: 12B