6608f27dbd3c5a6b6e4e2d67d04c2656b1436bcd68dedbe8552a4139bf279eaa[.]zip

General

Target
6608f27dbd3c5a6b6e4e2d67d04c2656b1436bcd68dedbe8552a4139bf279eaa.zip
Size 341KB
Sample250107-acdeqawnck
SHA256 6608f27dbd3c5a6b6e4e2d67d04c2656b1436bcd68dedbe8552a4139bf279eaa
MD5 a39ed623aef63d5c11bb013ecf051ea9
SHA1 930d8d0f47937eaa31839f81e7a6c20a5210e551
SHA512 fbbdb3f9dc55a16815c3ff7f2e42f222cac63d604ffa4805c895c27e11f6f6cf757c4893f55b13b53fe33b401e9671e79eb74e38f9bf4f8dfc25659cda601f3c
SSDEEP 6144:j+oMi/gsucRGvDyYxNe+mltbo3oFKW7rXBOfXTI8LMg6I9Oo4QJfm/U3iP:ZMsgsupvFL483oYW7rXCXkIZEJQJfjyP
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
static1/unpack001/yoyuds_build.exe	net_reactor

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/yoyuds_build.exe

File Explorer

6608f27dbd3c5a6b6e4e2d67d04c2656b1436bcd68dedbe8552a4139bf279eaa.zip

.zip 341KB
yoyuds_build.exe

.exe 361KB

6608f27dbd3c5a6b6e4e2d67d04c2656b1436bcd68dedbe8552a4139bf279eaa.zip

SHA256 6608f27dbd3c5a6b6e4e2d67d04c2656b1436bcd68dedbe8552a4139bf279eaa
MD5 a39ed623aef63d5c11bb013ecf051ea9
SHA1 930d8d0f47937eaa31839f81e7a6c20a5210e551
SHA512 fbbdb3f9dc55a16815c3ff7f2e42f222cac63d604ffa4805c895c27e11f6f6cf757c4893f55b13b53fe33b401e9671e79eb74e38f9bf4f8dfc25659cda601f3c
SSDEEP 6144:j+oMi/gsucRGvDyYxNe+mltbo3oFKW7rXBOfXTI8LMg6I9Oo4QJfm/U3iP:ZMsgsupvFL483oYW7rXCXkIZEJQJfjyP
MD5 SHA1 SHA512 SSDEEP

Password

infected

yoyuds_build.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 0eb552b6985668e7bffb1ccc3cbe69d05af1efc7d1f2916d728836ebf08275a9
MD5 c14b3e5e05e6005210183dd918b1dd2d
SHA1 32ade9c1c473af583d67a2d170c5f9a4e31ea949
SHA512 5b2cdb94c92fb9d82747642e238cc18d4c8580e88ed2f3c67ffc3c813a512db4c4476cd4eb24775d72a78829d2f7d00929e15455f66d1820264acf33e75cbc66
SSDEEP 6144:6hRMi/MsuKRGvpyYxNeamPtboFojK47rXBUfXbI8LM26I1Oo4QDfmgU3iw:6/MsMsuzv/t08Fo+47rXsXcI5cJQDf21
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

.NET Reactor proctector

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

42158

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

6608f27dbd3c5a6b6e4e2d67d04c2656b1436bcd68dedbe8552a4139bf279eaa.zip

yoyuds_build.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

6608f27dbd3c5a6b6e4e2d67d04c2656b1436bcd68dedbe8552a4139bf279eaa.zip

yoyuds_build.exe

mscoree

dotnet