Blackdots.pdb
Static task
static1
2 signatures
General
-
Target
Blackdots.exe
-
Size
7.9MB
-
MD5
45a628d146fb4613cad52857312a1fdf
-
SHA1
159e87b8b3efa7e71ffeb3c18260a76e6f74ef91
-
SHA256
095ad47a4bf7d4074237fbcc1f7a2861d50a613535eec0e4f45e023d3aededd1
-
SHA512
68c838a634689f565bd2382c8d442cb12b79a71d7c4697eeeaea17be79d4b5df395f367b3a14fbf3be03a4098e699b0c0c135c2826016296881cf6eb61cb3dbf
-
SSDEEP
196608:q3KApC5F/DWMa2v0luD46Ow3mpHBn7ZL8pUdkSI6WY07:SKAUv/DWT9lrqm557ZLHkSRd07
Score
7/10
Malware Config
Signatures
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule sample net_reactor -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Blackdots.exe
Files
-
Blackdots.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 7.8MB - Virtual size: 7.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ