099a4dfcf5f7cf48f6b632fe6b5e70ff
This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2024-Sep-01 13:21:45 |
| FileDescription | |
| FileVersion | 0.0.0.0 |
| InternalName | def_net.exe |
| LegalCopyright | |
| OriginalFilename | def_net.exe |
| ProductVersion | 0.0.0.0 |
| Assembly Version | 0.0.0.0 |
Plugin Output
| Info | Matching compiler(s): | Microsoft Visual C# v7.0 / Basic .NET |
| Malicious | VirusTotal score: 34/74 (Scanned on 2024-09-02 01:21:04) |
ALYac:
Gen:Variant.MSILKrypt.19
APEX: Malicious Arcabit: Trojan.MSILKrypt.19 Avira: TR/Dropper.Gen BitDefender: Gen:Variant.MSILKrypt.19 BitDefenderTheta: Gen:NN.ZemsilF.36812.3o0@aCviFmi Bkav: W32.AIDetectMalware.CS CrowdStrike: win/malicious_confidence_100% (D) Cybereason: malicious.cf5f7c Cylance: Unsafe DeepInstinct: MALICIOUS DrWeb: Trojan.PackedNET.2595 ESET-NOD32: a variant of MSIL/GenKryptik.FZQG Elastic: malicious (high confidence) Emsisoft: Gen:Variant.MSILKrypt.19 (B) F-Secure: Trojan.TR/Dropper.Gen FireEye: Generic.mg.099a4dfcf5f7cf48 Fortinet: MSIL/GenKryptik.FVDD!tr GData: Gen:Variant.MSILKrypt.19 Google: Detected Ikarus: Trojan.Agent Kaspersky: HEUR:Trojan.Win32.Generic MAX: malware (ai score=83) MaxSecure: Trojan.Malware.300983.susgen McAfeeD: Real Protect-LS!099A4DFCF5F7 MicroWorld-eScan: Gen:Variant.MSILKrypt.19 Microsoft: Trojan:MSIL/AsyncRAT.Z!MTB Rising: Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:SoL7pYDPnkIzbDUQPSKegg) SentinelOne: Static AI - Malicious PE Sophos: ML/PE-A Symantec: ML.Attribute.HighConfidence VIPRE: Gen:Variant.MSILKrypt.19 VirIT: Trojan.Win32.MSIL_Heur.A ZoneAlarm: HEUR:Trojan.Win32.Generic |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2024-Sep-01 13:21:45 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 11.0 |
| SizeOfCode | 0x2c3c00 |
| SizeOfInitializedData | 0x19000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x002C5A8E (Section: .text) |
| BaseOfCode | 0x2000 |
| BaseOfData | 0x2c6000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x2e2000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rsrc
.reloc
Imports
| mscoree.dll |
_CorExeMain
|
|---|
Delayed Imports
2
3
4
5
6
32512
1
1 (#2)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 0.0.0.0 |
| ProductVersion | 0.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| FileDescription | |
| FileVersion (#2) | 0.0.0.0 |
| InternalName | def_net.exe |
| LegalCopyright | |
| OriginalFilename | def_net.exe |
| ProductVersion (#2) | 0.0.0.0 |
| Assembly Version | 0.0.0.0 |
| Resource LangID | UNKNOWN |
|---|