Static task
static1
General
-
Target
Neuer Ordner.rar
-
Size
48.3MB
-
MD5
d54f5f3c56afed49aea89a522840eeb7
-
SHA1
5400b96c2ab22e4554f947201be96dee260e42d6
-
SHA256
5f6759111f931a8c0fd6844f8131a64d8ae9959bb0b3d001dbc7fc81be5ff366
-
SHA512
38134d6154fc130482dc4bab738a9fe3a6923510dd0483b08d4ba63f0c99da13e08fc22fdf91e8f5e0b822669bee6cf1cd01518da538b199218ba947a5cea2d8
-
SSDEEP
786432:qrHMh99shKg0fHnYb8dlfGe5b1TArtRq+UZ7/9O8gAbPDmEKJexfq:mHYgKZ/nYA+e9CBRNUNjfgey
Malware Config
Signatures
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule static1/unpack001/Neuer Ordner/Anarchy Panel.exe net_reactor -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Neuer Ordner/Anarchy Panel.exe
Files
-
Neuer Ordner.rar.rar
-
Neuer Ordner/Anarchy Panel.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 54.6MB - Virtual size: 54.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Neuer Ordner/Anarchy Panel.exe.config.xml