Wasper.pdb
Static task
static1
Behavioral task
behavioral1
Sample
64999e334c3522e0d00257389baf80b0N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
64999e334c3522e0d00257389baf80b0N.exe
Resource
win10v2004-20240802-en
General
-
Target
64999e334c3522e0d00257389baf80b0N.exe
-
Size
671KB
-
MD5
64999e334c3522e0d00257389baf80b0
-
SHA1
acac811b3d198ad350874ec412579155e0b658e0
-
SHA256
fcebb7f081227761e609c63c0f59b2f21142ac185221c58c48bc4cf1e8a1a147
-
SHA512
e33a4f35166ee5cc5dc66a041cd90b06f59d8f1e685b489ccaa6d097ae435a78da7d87cf68b18afdf8bc4844ae52b188583b96a4cca319debcc71781b959de47
-
SSDEEP
6144:Nosev9/u1VwjiVLk8voCEJkk9HwakqsYfECsiX6wuNK3vb0Q4H4:NodG1lQ8w9SSwaktonDcKD0Q4H4
Malware Config
Signatures
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule sample net_reactor -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 64999e334c3522e0d00257389baf80b0N.exe
Files
-
64999e334c3522e0d00257389baf80b0N.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Sections
.text Size: 500KB - Virtual size: 499KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 171KB - Virtual size: 170KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ