Manalyze report for 0af6cbd88b9fadc821efcfece9b95f91f113d69c7f0bec908a7aa4def13c5246

This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2026-Sep-24 14:07:51
Comments	Sos el vampiro. SobrevivÃ cinco noches.
FileDescription	Bloodloop
FileVersion	`0.2.0.0`
InternalName	Bloodloop.exe
LegalCopyright
OriginalFilename	Bloodloop.exe
ProductName	Bloodloop
ProductVersion	`0.2.0.0`
Assembly Version	0.2.0.0

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C# v7.0 / Basic .NET` `.NET executable -> Microsoft`
Suspicious	Strings found in the binary may indicate undesirable behavior:	`Contains references to internet browsers: chrome.exe`
Malicious	VirusTotal score: 10/71 (Scanned on 2026-09-24 14:32:34)	`APEX: Malicious` `Bkav: W32.Malware.97B8C3A6` `CrowdStrike: win/malicious_confidence_60% (D)` `Cylance: Unsafe` `DeepInstinct: MALICIOUS` `Elastic: malicious (moderate confidence)` `Kingsoft: malware.kb.c.920` `Malwarebytes: MachineLearning/Anomalous.96%` `MaxSecure: Trojan.Malware.300983.susgen` `Trapmine: malicious.moderate.ml.score`

Hashes

MD5	`354cffcd81c91abacf3ee850a79720f9` 🔍
SHA1	`a9d24710e5d7fe81ef8cbdce2af18232074c60cf` 🔍
SHA256	`0af6cbd88b9fadc821efcfece9b95f91f113d69c7f0bec908a7aa4def13c5246` 🔍
SHA3	`4df25817b5b3beffed6fa9d05f048290e17b86f240a0c765c9c1b9c3ef32a72f` 🔍
SSDeep	`192:tDEBqkWonqA7HIiuYIlqJE2ckNw0yQ3qvlrkdnz7:tDEMISYIlb2nFy2qtQdn` 🔍
Imports Hash	`f34d5f2d4577ed6d9ceec516c1f5a744` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`3`
TimeDateStamp	2026-Sep-24 14:07:51
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`11.0`
SizeOfCode	`0x1400`
SizeOfInitializedData	`0x1a00`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0000324E (Section: .text)`
BaseOfCode	`0x2000`
BaseOfData	`0x4000`
ImageBase	`0x400000`
SectionAlignment	`0x2000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`4.0`
Win32VersionValue	`0`
SizeOfImage	`0x8000`
SizeOfHeaders	`0x200`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_NO_SEH` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`fc44add03ad4d9717c769819a094a676 🔍`
SHA1	`f9fe0776d2f8e6cfa066a3c5f8c94569cc009089 🔍`
SHA256	`a9feb225b352efde258c4e3c06c44d913d3179e7b431cf7615b7e21e68efb868 🔍`
SHA3	`660c29d5a73e94fe9e095d185f48cee8d925e26efbc25ab971e53d4d6d2d3b7b 🔍`
VirtualSize	`0x1254`
VirtualAddress	`0x2000`
SizeOfRawData	`0x1400`
PointerToRawData	`0x200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`4.67394`

.rsrc

MD5	`3592f913decb8ee6240a38fe7db9f0a2 🔍`
SHA1	`9aa80fe9379548193d78ef1fb04b4ab317f3218a 🔍`
SHA256	`6c233b2081895490dea2aae7d77d32f62324bfe4983726e879fd9d932d4b2640 🔍`
SHA3	`64ae932b91ac6d6190141d03b99f24e2e4d33af5104b45738a8272a981c997dc 🔍`
VirtualSize	`0x17f0`
VirtualAddress	`0x4000`
SizeOfRawData	`0x1800`
PointerToRawData	`0x1600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.95365`

.reloc

MD5	`80780d9de55f8ed5a6a243f323e60c4e 🔍`
SHA1	`6a8619fa448ed6d5a3140fa1556682feec9551c7 🔍`
SHA256	`c8eca104027695bb2fc810ce12a70ec3fa7ac311025ab90c6750038a07f59c03 🔍`
SHA3	`599428f8f268c733175893f0802e11dddf77e55b5160b7c91afd9bfb86cc0420 🔍`
VirtualSize	`0xc`
VirtualAddress	`0x6000`
SizeOfRawData	`0x200`
PointerToRawData	`0x2e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.0815394`

Imports

mscoree.dll	`_CorExeMain`

Delayed Imports

2

Type	`RT_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x18d`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.24635`
Detected Filetype	PNG graphic file
MD5	`b0cc6fc9a00982b1599612b975919582 🔍`
SHA1	`68a1975d6f95d75065b09fafd9f7d4fccf38b8d4 🔍`
SHA256	`46a792bcf757f9cbfc29527c6a9df81e49b84ee7836d905ef496396507fe8fdb 🔍`
SHA3	`d3e0925c059f2b481c8ef91cc7cccbc63494729d004afae142bd678a4df6eb48 🔍`

3

Type	`RT_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x1e7`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.32922`
Detected Filetype	PNG graphic file
MD5	`2a1908f5527fd7dae1095bda01b18dc9 🔍`
SHA1	`8cc378ba4fb08c51b2e1177da35f65e0df7d9c93 🔍`
SHA256	`648d9359fbb14948eab83c0b7d90693a69766c2cccf085e99d214bc0ba8a6198 🔍`
SHA3	`e4645742be5055482d0c3c1c5f930352adc39bddac7b16cf9314486b73d384b0 🔍`

4

Type	`RT_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x254`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.41451`
Detected Filetype	PNG graphic file
MD5	`79261bbc84b0e288b6c7ef5f0dd59aae 🔍`
SHA1	`68eb963de614229df9a74beb3c3410c5c504730a 🔍`
SHA256	`4140fc2039ee599e5e61a476267a2f1eb9f60e7a6a8c577f5ddad01ff36b8be6 🔍`
SHA3	`38edb88b4594ae10318860c40489cd833a7c12b792617ef35ef42cd1ad7533e3 🔍`

5

Type	`RT_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0xb33`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.4299`
Detected Filetype	PNG graphic file
MD5	`2e5d0575981cab55a9329a8a68afb364 🔍`
SHA1	`6942be5c1b6ce12bd763aa2bef2ed0760ce5a1a0 🔍`
SHA256	`d5c0be33c6d65fce6000231308d74184b44bdec767bf144dfd50278edc64e132 🔍`
SHA3	`f40a893a8429046e961c68c387f6904958b43734d2eab516211b98ded9b15215 🔍`

32512

Type	`RT_GROUP_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x3e`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.46815`
Detected Filetype	Icon file
MD5	`b8dce9f9679453ec97c17ba4faf1714c 🔍`
SHA1	`923f5704eea8abfe2ed94b115335092cdaabb1e9 🔍`
SHA256	`4b74f806e7addf9f2e59e8b510f8f5eb71e5741d05a267b1276a4a8f887246a5 🔍`
SHA3	`a24896d52af4066f08e3c78475ede7244e4a016691442d65129a365d386f654a 🔍`

1

Type	`RT_VERSION`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x2f8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.27677`
MD5	`4192d646dbeb9f585043705998184ca1 🔍`
SHA1	`d021eb10e3e5552ece5cede6b65a8c2273906f0d 🔍`
SHA256	`0eaefac40d8bb3341aa0e182e1c895f9dbfe4cda4f8068eb74ba7872fe5dc3c6 🔍`
SHA3	`11ba55eabb4bd8a1c865a1fbc22473c6737367ba373362dcdf672f36ebd885c7 🔍`

1 (#2)

Type	`RT_MANIFEST`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x1ea`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.00112`
MD5	`a19a2658ba69030c6ac9d11fd7d7e3c1 🔍`
SHA1	`879dcf690e5bf1941b27cf13c8bcf72f8356c650 🔍`
SHA256	`c0085eb467d2fc9c9f395047e057183b3cd1503a4087d0db565161c13527a76f 🔍`
SHA3	`93cbaf236d2d3870c1052716416ddf1c34f21532e56dd70144e9a01efcd0ce34 🔍`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	0.2.0.0
ProductVersion	0.2.0.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	UNKNOWN
Comments	Sos el vampiro. SobrevivÃ cinco noches.
FileDescription	Bloodloop
FileVersion (#2)	0.2.0.0
InternalName	Bloodloop.exe
LegalCopyright
OriginalFilename	Bloodloop.exe
ProductName	Bloodloop
ProductVersion (#2)	0.2.0.0
Assembly Version	0.2.0.0

Resource LangID	UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.