8f3b34b315bd476cebf5e2206dc8c86969ff4d1024254dda10380c59053c25a4[.]zip | Triage

Sharing

General

Target

8f3b34b315bd476cebf5e2206dc8c86969ff4d1024254dda10380c59053c25a4.zip
Size

361KB
MD5

18b04105c3642271c251881ad8ae7e82
SHA1

4c1e71acc06f7e3c19c82fd2b3cdd77c0423ed6b
SHA256

8f3b34b315bd476cebf5e2206dc8c86969ff4d1024254dda10380c59053c25a4
SHA512

57ed699ccd27281148c9d60d4b6c6dca71f5b3d5275b8b4c3f00b38efd77d0e0b5e558b3ccb68225a279093cd7686a5f25592eb59f0ee9dab706148776761a99
SSDEEP

6144:7YT9J0Hfev0iPtGdYClOsPTnKBwNIm7yCegxhuDNzrrbOq5HcKqQwbeGFuO:qAmvfPtGdflnTSRJ8iDd/opP6Y

Score

7^/10

Malware Config

Signatures

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
sample	net_reactor

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8f3b34b315bd476cebf5e2206dc8c86969ff4d1024254dda10380c59053c25a4.zip

Files

8f3b34b315bd476cebf5e2206dc8c86969ff4d1024254dda10380c59053c25a4.zip
.exe windows:4 windows x86 arch:x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 578B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.bss
Size: 325KB - Virtual size: 325KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE