Static task
static1
Behavioral task
behavioral1
Sample
c004adf9200f82a0154cf424036e25256e2c4478ed3cf38a245fa10b3b002f69.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c004adf9200f82a0154cf424036e25256e2c4478ed3cf38a245fa10b3b002f69.exe
Resource
win10v2004-20240709-en
General
-
Target
c004adf9200f82a0154cf424036e25256e2c4478ed3cf38a245fa10b3b002f69.exe
-
Size
14.8MB
-
MD5
201ec2f7b087e3ca36f271b35c662d3c
-
SHA1
99f1146550f28dd1828ccf2962df1b8182d6d8a6
-
SHA256
c004adf9200f82a0154cf424036e25256e2c4478ed3cf38a245fa10b3b002f69
-
SHA512
d52e7364e1bfb8c0e828ae96bcba3c5a2d783d36a13e5113973db2e70a34ca9258d298bc44ac8cde024573fa34ef225804759745650f11019708277642cdffe2
-
SSDEEP
196608:OuoDktaVNHIoS9C4kNir2yv7wPWpGplR806IIIIIIIIIIIIIIIIIIIIIIIIIIII2:OuiKaVNHIoS9Cx1yvkPWpGplR8ZW
Malware Config
Signatures
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule sample net_reactor -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c004adf9200f82a0154cf424036e25256e2c4478ed3cf38a245fa10b3b002f69.exe
Files
-
c004adf9200f82a0154cf424036e25256e2c4478ed3cf38a245fa10b3b002f69.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 360KB - Virtual size: 360KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ