0cfa5f7c008e3dc2df275a99aef9cbbb
This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2022-Aug-01 22:16:12 |
| Comments | SSH, Telnet, Rlogin, and SUPDUP client |
| CompanyName | Simon Tatham |
| FileDescription | SSH, Telnet, Rlogin, and SUPDUP client |
| FileVersion | 0.77.0.0 |
| InternalName | 1.exe |
| LegalCopyright | Copyright © 1997-2022 Simon Tatham. |
| LegalTrademarks | |
| OriginalFilename | 1.exe |
| ProductName | PuTTY suite |
| ProductVersion | 0.77.0.0 |
| Assembly Version | 0.77.0.0 |
Plugin Output
| Info | Matching compiler(s): |
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual C++ 8.0 .NET executable -> Microsoft |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Malicious | VirusTotal score: 57/72 (Scanned on 2022-10-16 16:19:03) |
Bkav:
W32.AIDetectNet.01
Lionic: Trojan.MSIL.Seraph.a!c DrWeb: Trojan.Inject4.39224 MicroWorld-eScan: IL:Trojan.MSILZilla.22406 ALYac: Trojan.Downloader.MSIL.Seraph Cylance: Unsafe Zillya: Downloader.Agent.Win32.484169 Sangfor: Downloader.Msil.Nanocore.Vk9x K7AntiVirus: Trojan-Downloader ( 005967611 ) Alibaba: TrojanDownloader:MSIL/NanoCore.0b98bfd7 K7GW: Trojan-Downloader ( 005967611 ) Cybereason: malicious.8a8227 BitDefenderTheta: Gen:NN.ZemsilF.34726.Qm0@a4CmeRn Cyren: W32/MSIL_Agent.DRO.gen!Eldorado Symantec: ML.Attribute.HighConfidence Elastic: malicious (high confidence) ESET-NOD32: a variant of MSIL/TrojanDownloader.Agent.MVU APEX: Malicious TrendMicro-HouseCall: Backdoor.Win32.ASYNCRAT.YXCINZ Paloalto: generic.ml Kaspersky: HEUR:Trojan-Downloader.MSIL.Seraph.gen BitDefender: IL:Trojan.MSILZilla.22406 NANO-Antivirus: Trojan.Win32.Seraph.jqywpa Avast: Win32:DropperX-gen [Drp] Rising: Trojan.Generic/MSIL@AI.94 (RDM.MSIL:ihz3dLq2mpiECoWUXQqwYg) Ad-Aware: IL:Trojan.MSILZilla.22406 Emsisoft: IL:Trojan.MSILZilla.22406 (B) VIPRE: IL:Trojan.MSILZilla.22406 TrendMicro: Backdoor.Win32.ASYNCRAT.YXCINZ McAfee-GW-Edition: BehavesLike.Win32.Packed.jh FireEye: Generic.mg.0cfa5f7c008e3dc2 Sophos: Mal/Generic-S Ikarus: Trojan.MSIL.Inject GData: IL:Trojan.MSILZilla.22406 Jiangmin: TrojanDownloader.MSIL.amdp Webroot: W32.Trojan.Gen Google: Detected Avira: TR/Dldr.Agent.lyszs Antiy-AVL: Trojan/Generic.ASMalwS.6FC2 Gridinsoft: Ransom.Win32.Sabsik.sa Arcabit: IL:Trojan.MSILZilla.D5786 ZoneAlarm: HEUR:Trojan-Downloader.MSIL.Seraph.gen Microsoft: TrojanDownloader:MSIL/NanoCore.D!MTB Cynet: Malicious (score: 100) AhnLab-V3: Trojan/Win.Leonem.C5218555 Acronis: suspicious McAfee: RDN/Generic Downloader.x MAX: malware (ai score=100) VBA32: TScope.Trojan.MSIL Malwarebytes: Trojan.Downloader Tencent: Msil.Trojan-Downloader.Ader.Qsmw SentinelOne: Static AI - Malicious PE MaxSecure: Trojan.Malware.74570710.susgen Fortinet: MSIL/Small.CWH!tr AVG: Win32:DropperX-gen [Drp] Panda: Trj/Chgt.AD CrowdStrike: win/malicious_confidence_100% (W) |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2022-Aug-01 22:16:12 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 48.0 |
| SizeOfCode | 0x6cc00 |
| SizeOfInitializedData | 0x3d800 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0006EAFE (Section: .text) |
| BaseOfCode | 0x2000 |
| BaseOfData | 0 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xb0000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0xb7484 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rsrc
.reloc
Imports
| mscoree.dll |
_CorExeMain
|
|---|
Delayed Imports
1
32512
1 (#2)
1 (#3)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 0.77.0.0 |
| ProductVersion | 0.77.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| Comments | SSH, Telnet, Rlogin, and SUPDUP client |
| CompanyName | Simon Tatham |
| FileDescription | SSH, Telnet, Rlogin, and SUPDUP client |
| FileVersion (#2) | 0.77.0.0 |
| InternalName | 1.exe |
| LegalCopyright | Copyright © 1997-2022 Simon Tatham. |
| LegalTrademarks | |
| OriginalFilename | 1.exe |
| ProductName | PuTTY suite |
| ProductVersion (#2) | 0.77.0.0 |
| Assembly Version | 0.77.0.0 |
| Resource LangID | UNKNOWN |
|---|