stage4_inmemory[.]exe

General

Target

stage4_inmemory.exe
Size

1.2MB
MD5

8e8280ed88a5435880a63873367b2fc9
SHA1

45bd86a0c42647a66e164e564abfc4b43ad4243b
SHA256

af86b32a933800cf30edb4f8f40cddd74253f599eb3edc8aa643fdfd30621f0b
SHA512

d0d11b59a22f9298c82834c25be137f740e82c91f327f4c883d38bc63caa61c4afbb69a2b0bc76be60201cf69c5e97fbb9b50c9ae745debf741284405efe4218
SSDEEP

24576:+cWEAED8iMPtLVSLRw4ngZDEtvFAK4xwheL57FpbQLYffegKWz2NbGN7Tig:r8Jt4LRfIEtvFJhheL55pbQkffegCNC

Score

7^/10

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
sample	net_reactor

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
stage4_inmemory.exe