Manalyze report for 1c2bd3bcb860d67bce367a3f703f64ea

This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2018-Aug-11 18:50:49
Comments	Authorization Manager
CompanyName
FileDescription	Microsoft® Authorization Manager
FileVersion	`0.1.5.0`
InternalName	Kraken.exe
LegalCopyright	© Microsoft Corporation. All righrs reserved.
LegalTrademarks
OriginalFilename	Kraken.exe
ProductName	Microsoft® Windows® Operation System®
ProductVersion	`0.1.5.0`
Assembly Version	0.1.5.0

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C# v7.0 / Basic .NET`
Suspicious	PEiD Signature:	`UPX V2.00-V2.90 -> Markus Oberhumer & Laszlo Molnar & John Reiser` `UPX -> www.upx.sourceforge.net` `UPX V2.00-V2.90 -> Markus Oberhumer & Laszlo Molnar & John Reiser` `UPX 2.00-3.0X -> Markus Oberhumer & Laszlo Molnar & John Reiser`
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to SHA1` `Uses constants related to SHA256`
Info	The PE is digitally signed.	`Signer: NGO` `Issuer: NGO`
Malicious	VirusTotal score: 43/66 (Scanned on 2018-11-07 01:33:46)	`MicroWorld-eScan: Trojan.GenericKD.31168063` `CAT-QuickHeal: Trojan.Tiggre` `McAfee: RDN/Ransom` `Malwarebytes: Ransom.Kraken` `K7GW: Trojan ( 0053af6e1 )` `K7AntiVirus: Trojan ( 0053af6e1 )` `TrendMicro: Ransom_KRAKEN.THHBBAH` `NANO-Antivirus: Trojan.Win32.Filecoder.fhqdea` `Symantec: Trojan.Gen.2` `TrendMicro-HouseCall: Ransom_KRAKEN.THHBBAH` `Avast: Win32:Malware-gen` `Kaspersky: HEUR:Trojan-Ransom.Win32.Agent.gen` `BitDefender: Trojan.GenericKD.31168063` `ViRobot: Trojan.Win32.S.KrakenCryptor.180704` `Tencent: Win32.Trojan.Falsesign.Dygx` `Ad-Aware: Trojan.GenericKD.31168063` `Emsisoft: Trojan.GenericKD.31168063 (B)` `F-Secure: Trojan.GenericKD.31168063` `Invincea: heuristic` `McAfee-GW-Edition: RDN/Ransom` `Sophos: Mal/Krakryp-A` `Paloalto: generic.ml` `Cyren: W32/Trojan.GVRB-2511` `Jiangmin: Trojan.Agent.bodq` `Webroot: W32.Malware.gen` `Avira: TR/Ransom.efijl` `Fortinet: W32/Agent!tr` `Endgame: malicious (moderate confidence)` `Arcabit: Trojan.Generic.D1DB963F` `ZoneAlarm: HEUR:Trojan-Ransom.Win32.Agent.gen` `Microsoft: Ransom:MSIL/Kraken.A` `TACHYON: Ransom/W32.Kraken.180704` `ALYac: Trojan.Ransom.KrakenCryptor` `Cylance: Unsafe` `ESET-NOD32: MSIL/Filecoder.OU` `Rising: Ransom.Kraken!1.B3AD (CLOUD)` `Yandex: Trojan.Filecoder!N/HhD53qLIQ` `GData: Win32.Trojan-Ransom.KrakenCryptor.A` `AVG: Win32:Malware-gen` `Cybereason: malicious.b666df` `Panda: Trj/GdSda.A` `CrowdStrike: malicious_confidence_100% (W)` `Qihoo-360: Win32/Trojan.Ransom.b44`

Hashes

MD5	`1c2bd3bcb860d67bce367a3f703f64ea`
SHA1	`4541b8ab666dff77aa07831561788e6c41e7a0bb`
SHA256	`e8afae434aa9c3a3c848aa1f0809ebbddb6c88d45f39ba4306bbdefac4e59207`
SHA3	`84e97206d3d6319de8e37a5cdafc4b4c3e47aa0bd74fc74feb28614715968592`
SSDeep	`3072:UFMSY9OnXarbSb6H1zHi6Cm0sG8ZUc0RqWDJXX/VHKDThXOoO8ogK:UE4Kqb+z1CmaZc00cZPVHLP8q`
Imports Hash	`f34d5f2d4577ed6d9ceec516c1f5a744`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`3`
TimeDateStamp	2018-Aug-11 18:50:49
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`8.0`
SizeOfCode	`0x2a800`
SizeOfInitializedData	`0x1400`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0002C700 (Section: .text)`
BaseOfCode	`0x2000`
BaseOfData	`0x2e000`
ImageBase	`0x400000`
SectionAlignment	`0x2000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`4.0`
Win32VersionValue	`0`
SizeOfImage	`0x32000`
SizeOfHeaders	`0x200`
Checksum	`0x381f1`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_NO_SEH` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`63f0fbfd68891bd869cce6f0617dfc8d`
SHA1	`426d2bbea0d7baa1ab96086b3ef20607ebe104dc`
SHA256	`7968a7555db7a7fe98c7c5a43438867b69ec638411a714442f9dae49293171da`
SHA3	`9cd393fc7095b661fc9d46748289bee239f89b52e6771c2f12bf8aa1a55e3a00`
VirtualSize	`0x2a706`
VirtualAddress	`0x2000`
SizeOfRawData	`0x2a800`
PointerToRawData	`0x200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`7.08727`

.rsrc

MD5	`494e850936b4a012fec675eeeeea4a88`
SHA1	`76933e407d64a818e24a9445a7bedf3f84441a2c`
SHA256	`4c3fa2059330de58c4d5a3d510dac70ae25cf4bd87fdafe399c9f15da1e35f88`
SHA3	`41524d84e9866c892e23bab6e029bd2212b9d433572f30751c6eca7a203268b0`
VirtualSize	`0x119f`
VirtualAddress	`0x2e000`
SizeOfRawData	`0x1200`
PointerToRawData	`0x2aa00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.96761`

.reloc

MD5	`d60a5d6d80bb8079629c957e33335457`
SHA1	`a833e7bd3a937bfb67319dd84d4f64217f4b5223`
SHA256	`1074b28f68fe06a2b20e1e880bfa23a22af3f57997f7c2f8331813ce8c751512`
SHA3	`a2b37613e7d721134e1c755e717a836b67a4abdd4e2537d1540d0b6668050f37`
VirtualSize	`0xc`
VirtualAddress	`0x30000`
SizeOfRawData	`0x200`
PointerToRawData	`0x2bc00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.0980042`

Imports

mscoree.dll	`_CorExeMain`

Delayed Imports

1

Type	`RT_VERSION`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x3dc`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.36273`
MD5	`61ec0408e3ef8e432c65579c3598071e`
SHA1	`0d6cb4a0271eb66f1ae7715d57bde6e85d1e97c0`
SHA256	`c89f175d89a1404a844ecb35983b89eb9478bcf00d796105579cd6f844896244`
SHA3	`a20f8ebf7b2c0df8c9f9df096e7bcd39f2272dd575a1659004a009f766ccc687`

1 (#2)

Type	`RT_MANIFEST`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0xd2b`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.99207`
MD5	`fe7e22736538240fd830f05adc29a370`
SHA1	`e3b43859e368849945a8f28f450e3fca649386f0`
SHA256	`a5a6aa71b380d1479bb987034aac0a553f9e72ede55296e3bfc5c7de48745e61`
SHA3	`f3a4424c9b74fac073bdcdeede8d19a24e4be639c8501e7070b6c96a73d5bac0`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	0.1.5.0
ProductVersion	0.1.5.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	UNKNOWN
Comments	Authorization Manager
CompanyName
FileDescription	Microsoft® Authorization Manager
FileVersion (#2)	0.1.5.0
InternalName	Kraken.exe
LegalCopyright	© Microsoft Corporation. All righrs reserved.
LegalTrademarks
OriginalFilename	Kraken.exe
ProductName	Microsoft® Windows® Operation System®
ProductVersion (#2)	0.1.5.0
Assembly Version	0.1.5.0

Resource LangID	UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

1c2bd3bcb860d67bce367a3f703f64ea

Summary

Plugin Output

Hashes

DOS Header

PE Header

Image Optional Header

.text

.rsrc

.reloc

Imports

Delayed Imports

1

1 (#2)

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors