TGN EXPLOIT X.pdb
Static task
static1
Behavioral task
behavioral1
Sample
TGN EXPLOIT X.exe
Resource
win11-20240802-en
General
-
Target
TGN EXPLOIT X.exe
-
Size
3.5MB
-
MD5
e1995bc771bb8813dced713056d282f8
-
SHA1
50b3f8e9681bedfd89ed4d9c6492c3cf92d600e0
-
SHA256
17850ca481e71dafedb24a376ce8b431005a38bbe2f4c87ee2504ca92cf150f6
-
SHA512
47580c2fa498ba5f3027c71e44c92117a1b9f4d1110bd3bac232e552cfc94f023ee4f16af92ed00e9d3be881fcfba1adaaf2863e58149625b1aba6df12075cb0
-
SSDEEP
98304:KPHp/s7+5PS1/mHkaioNjcLq+QqsSgawRMt2WuPmD:KPHF58mHkMCq5qo5RmYPs
Malware Config
Signatures
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule sample net_reactor -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource TGN EXPLOIT X.exe
Files
-
TGN EXPLOIT X.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ