Manalyze report for 1d52cc3c30535edb67d6f15e6d8d9b192cc92adf34fbf6346a7dd1e345923606

This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2095-Jun-25 14:09:54
Comments
CompanyName
FileDescription	æ©å±å±
FileVersion	`1.0.0.0`
InternalName	GeekStyle.exe
LegalCopyright	Copyright Â© 2021
LegalTrademarks
OriginalFilename	GeekStyle.exe
ProductName	æ©å±å±
ProductVersion	`1.0.0.0`
Assembly Version	1.0.0.0

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C# v7.0 / Basic .NET` `.NET executable -> Microsoft`
Suspicious	Strings found in the binary may indicate undesirable behavior:	`May have dropper capabilities: CurrentVersion\Run` `Contains domain names: etouch.cn http://wthrcdn.etouch.cn http://wthrcdn.etouch.cn/weather_mini?city wthrcdn.etouch.cn`
Malicious	VirusTotal score: 7/70 (Scanned on 2026-06-29 03:40:08)	`APEX: Malicious` `CrowdStrike: win/malicious_confidence_70% (W)` `Elastic: malicious (moderate confidence)` `MaxSecure: Trojan.Malware.300983.susgen` `McAfeeD: ti!1D52CC3C3053` `Sangfor: Trojan.Win32.Save.a` `TrendMicro-HouseCall: Trojan.MSIL.Gen.TL0101ER26ZT`

Hashes

MD5	`64c8f1d17901c01d166a78b990f81374` 🔍
SHA1	`576c7a0b0f52293215b094291d99cca4c1f803af` 🔍
SHA256	`1d52cc3c30535edb67d6f15e6d8d9b192cc92adf34fbf6346a7dd1e345923606` 🔍
SHA3	`7c5102ebb46354455cdbc89f19c225bccdd72807d4ff96490d844fdc6be75590` 🔍
SSDeep	`24576:S4VvrsfOTXXl6h3BWeQ31XhZsVDsHJnKP/yVgrdOd/Sut/NLblGJt6hxIBFFrHy:S4VvrCOTXVuiAuU6amSutlLbcJtu` 🔍
Imports Hash	`f34d5f2d4577ed6d9ceec516c1f5a744` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`3`
TimeDateStamp	2095-Jun-25 14:09:54
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`48.0`
SizeOfCode	`0x1d7c00`
SizeOfInitializedData	`0x2600`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x001D9AA6 (Section: .text)`
BaseOfCode	`0x2000`
BaseOfData	`0x1da000`
ImageBase	`0x400000`
SectionAlignment	`0x2000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x1e0000`
SizeOfHeaders	`0x200`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NO_SEH` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`06f10c4c3884b1fce2a0ad36cc38344a 🔍`
SHA1	`f58a797f459de8d952cc021e0f7f88cf771fbbb2 🔍`
SHA256	`6b99da9d54d284a2658dbb5222c0b7e07522052ded722a66e5ffc9fc058be0e5 🔍`
SHA3	`74cc2c9cc1e0220c6b1f1a0d51c0ac940caf7255803a0fc7ded4399d8ca120e3 🔍`
VirtualSize	`0x1d7aac`
VirtualAddress	`0x2000`
SizeOfRawData	`0x1d7c00`
PointerToRawData	`0x200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`7.88531`

.rsrc

MD5	`91980202b3acb1937dec641634cfeb63 🔍`
SHA1	`def0ba8660ad968644ee7f061d4d8ac6b8466e39 🔍`
SHA256	`e8046a85e7441a8dbb9ac17e86e4fa02295d15ae45ffdb58cf112aefad4c824d 🔍`
SHA3	`004773175ca2d886d4e1c6b0601fcd0c5ff2b784798a709754f1291985634a22 🔍`
VirtualSize	`0x22cc`
VirtualAddress	`0x1da000`
SizeOfRawData	`0x2400`
PointerToRawData	`0x1d7e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.43935`

.reloc

MD5	`3dc57ea5fe86cc4b57b12e206b527d2f 🔍`
SHA1	`b9472656cfb3c404fc32fcbda1f47bc2f3c4b50d 🔍`
SHA256	`5a512a5563e457c488a89a827e0532860c594cd4944c1366a80784c0517546c8 🔍`
SHA3	`c927e3b88b2f854bd1682564bfc7b20eda6f8f2ca7ffba7eff0d4ab8c5c30cdb 🔍`
VirtualSize	`0xc`
VirtualAddress	`0x1de000`
SizeOfRawData	`0x200`
PointerToRawData	`0x1da200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.10191`

Imports

mscoree.dll	`_CorExeMain`

Delayed Imports

1

Type	`RT_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x10a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.28676`
MD5	`6cbea8b4dc5edc0cbf9646e85b85b625 🔍`
SHA1	`7054e23bc39a21f45378e56911370319f5583797 🔍`
SHA256	`8c3c4a4dbbb391e5e6aaa6c6d3528773fd8609340be8c42b5de9d37651797658 🔍`
SHA3	`d767f03114d3551521f6c15ad2d09e64761509698f0c09e6cf44fd15f09278bb 🔍`

32512

Type	`RT_GROUP_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x14`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`1.7815`
Detected Filetype	Icon file
MD5	`3c68f77c35c26ff079a1c410ee44fa62 🔍`
SHA1	`0b40150c95fc2c6414c90d44ee78b8d8814b3393 🔍`
SHA256	`a14e70ed824f3f17d3a51136aa08839954d6d3ccadaa067415c7bfc08e6636b0 🔍`
SHA3	`590dcbf2ec3f485a6c24e3e627f383ee7588eb49978321f12c07d8190a6c1396 🔍`

1 (#2)

Type	`RT_VERSION`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x304`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.32308`
MD5	`5ab78bc63f9b1c9d613db5aa7dae0c78 🔍`
SHA1	`2801946bea15de57b84ecdc9e28b412f17ae63e1 🔍`
SHA256	`e1059f60f113cc5048ef83c1a780d4ee16bd9d4dfd21ba55ac2237f7b861c2fc 🔍`
SHA3	`1058b7cfc1282ed9c283d71f61819e910cb1a48714c82347bfc16ac691051174 🔍`

1 (#3)

Type	`RT_MANIFEST`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0xdd6`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.88134`
MD5	`c6337042a33d1d6ef5f84402dd1ae0e6 🔍`
SHA1	`13c1014e085885cef21fd4c7c5e26e0173b74803 🔍`
SHA256	`b2fe36f1b4f940189b32fd3725d2155a3671c6366663fe0e9c2467c0c2267190 🔍`
SHA3	`bf522fb27483e041d7c1b2a7b198c2b056669018ed3f403389576262638c03ba 🔍`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	1.0.0.0
ProductVersion	1.0.0.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	UNKNOWN
Comments
CompanyName
FileDescription	æ©å±å±
FileVersion (#2)	1.0.0.0
InternalName	GeekStyle.exe
LegalCopyright	Copyright Â© 2021
LegalTrademarks
OriginalFilename	GeekStyle.exe
ProductName	æ©å±å±
ProductVersion (#2)	1.0.0.0
Assembly Version	1.0.0.0

Resource LangID	UNKNOWN

UNKNOWN

Characteristics	`0`
TimeDateStamp	1970-Jan-01 00:00:00
Version	`0.0`
SizeofData	`0`
AddressOfRawData	`0`
PointerToRawData	`0`

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.