Static task
static1
Behavioral task
behavioral1
Sample
elysian.unreal.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
elysian.unreal.dll
Resource
win10v2004-20240802-en
General
-
Target
elysian.unreal.dll
-
Size
2.0MB
-
MD5
6f68f22dcb519396fbc11b2cbdab1c71
-
SHA1
f1042d1594234a51a7a294168c26fc9ab1e77d2a
-
SHA256
9a6a723e900b50c923a0eab25685dcfb1875f733feeccbb79e2b41bc9a8f09fa
-
SHA512
177078d07f3d436e0cc39e1a33c6226cbef44568a0aa806af9bd054587e64e1422427562286a2c1d093d118bb9b50dc00ece8fa7b9d43a100025b5df4d26a09f
-
SSDEEP
49152:wGff07UwnlBhjWX9KotpwAclHm2J5poc0H0rw/OwC4mMFUOCN5SJaL2xkM+uxHRC:wGH7Jn
Malware Config
Signatures
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule sample net_reactor -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource elysian.unreal.dll
Files
-
elysian.unreal.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 852B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ