Premium.pdb
Static task
static1
Behavioral task
behavioral1
Sample
f7f0f7e752b4e4980b09238f10d76eea72de558e2de94f823db2b84a32a66bc0.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
f7f0f7e752b4e4980b09238f10d76eea72de558e2de94f823db2b84a32a66bc0.exe
Resource
win10v2004-20240709-en
General
-
Target
f7f0f7e752b4e4980b09238f10d76eea72de558e2de94f823db2b84a32a66bc0.exe
-
Size
1.3MB
-
MD5
191be7f4a5d0eeb19152c4e3afd6b0a6
-
SHA1
e51c59abd38a76d87ccf644bdd8116fc2f507fb7
-
SHA256
f7f0f7e752b4e4980b09238f10d76eea72de558e2de94f823db2b84a32a66bc0
-
SHA512
199d60e3987f563f0c1c751edc360398d0f03842dbd1059ab9e1cbee4f07693b69de49ad958d127cadb1f2a03d519cf8eebb34c852e6bb4429e899db868ed353
-
SSDEEP
24576:XlIgx5Zfo6wvU1/5IIfWwtfpG/IwS2/TpCBbOkk1vjaEgsh+6:XlDd4s12I+gxG/2M0ZOk9Egsh
Malware Config
Signatures
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule sample net_reactor -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f7f0f7e752b4e4980b09238f10d76eea72de558e2de94f823db2b84a32a66bc0.exe
Files
-
f7f0f7e752b4e4980b09238f10d76eea72de558e2de94f823db2b84a32a66bc0.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Sections
.text Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ