Manalyze report for 207c64db9fe475d1ac45c4a59ea10bfbfe561ffd0d17fa5837c5c90e38dd03d9

This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2021-Sep-02 14:51:50
CompanyName	Avaya Inc.
FileDescription	setup
FileVersion	`1.0.0.0`
InternalName	setup.exe
LegalCopyright	Copyright Â© Avaya Inc. 2009
OriginalFilename	setup.exe
ProductName	setup
ProductVersion	`1.0.0.0`
Assembly Version	1.0.0.0

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C# v7.0 / Basic .NET` `.NET executable -> Microsoft`
Info	The PE is digitally signed.	`Signer: Avaya Inc.` `Issuer: Entrust Code Signing CA - OVCS1`
Safe	VirusTotal score: 0/72 (Scanned on 2025-07-10 09:28:00)	`All the AVs think this file is safe.`

Hashes

MD5	`b7a338e69637d9a0783ab66e3ffb9ec4`
SHA1	`1b6848fde67aa1b32b48d821d130dfec707f8adf`
SHA256	`207c64db9fe475d1ac45c4a59ea10bfbfe561ffd0d17fa5837c5c90e38dd03d9`
SHA3	`abc6bacae3478480ab71f1ac920231bb3869f51143067d67ba01d3b708048866`
SSDeep	`768:I29M6Ksk4DgTHPAru8djkfNQzYcCeMqgONXoN266w:A6KskWgk9djkViMCm6w`
Imports Hash	`f34d5f2d4577ed6d9ceec516c1f5a744`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`3`
TimeDateStamp	2021-Sep-02 14:51:50
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`11.0`
SizeOfCode	`0x6400`
SizeOfInitializedData	`0xe00`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0000820E (Section: .text)`
BaseOfCode	`0x2000`
BaseOfData	`0xa000`
ImageBase	`0x400000`
SectionAlignment	`0x2000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0xe000`
SizeOfHeaders	`0x200`
Checksum	`0xa776`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NO_SEH` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`703d89f4e4e10e21670c5e9982ef03d1`
SHA1	`221d39e5f6971e2d894e2ba0c5dd18ac97ff92bd`
SHA256	`243ebeb4e1b480e5edb26134e27dca18eb9c4f289dabd467daf455c2371a5719`
SHA3	`0a994c8d84ff358d0a64bfce894f62e808471dcf46247687279f0f6b78e5a60a`
VirtualSize	`0x6214`
VirtualAddress	`0x2000`
SizeOfRawData	`0x6400`
PointerToRawData	`0x200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`5.30412`

.rsrc

MD5	`3aad09c5ed7d7f110ce6c33006788ec2`
SHA1	`062d9caf7ab231e01b56bcece2385303beba9f53`
SHA256	`3f4d3c15eb31b9d658d9e9466584b19f0ba2617e5a3107f6c4ac35893f9cba39`
SHA3	`4a2ac31ba02609dd8ace6a1ecc9b97ee439b73230610cee7bc4488acaf83f4f3`
VirtualSize	`0xbd8`
VirtualAddress	`0xa000`
SizeOfRawData	`0xc00`
PointerToRawData	`0x6600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.9641`

.reloc

MD5	`1eef43c1f144291b3356c4d657432d65`
SHA1	`872a5258f770b5c5df8b85fad925723d587c9a2f`
SHA256	`6a1d59b1b9c1edd2bb2d92a57fa952ed8302623bb374e2acd6319a9190b40b05`
SHA3	`2c3aee67cf93448b215ccce9b6446fc16910fd31778b4fc9c8d044891c60205b`
VirtualSize	`0xc`
VirtualAddress	`0xc000`
SizeOfRawData	`0x200`
PointerToRawData	`0x7200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.0815394`

Imports

mscoree.dll	`_CorExeMain`

Delayed Imports

1

Type	`RT_VERSION`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x2dc`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.30136`
MD5	`03831ce9f5f474f4e058565fce4c23d1`
SHA1	`8758051775670030378dd91d016f221036bfd8c7`
SHA256	`8d04b1c53847fe88ed80cf5e7aec64760bb583e9c37a8ed2b8e47473ae60c760`
SHA3	`adff61c2a14e0568443ada02c3b858923bd4549f69e337f9699d48357c8fab70`

1 (#2)

Type	`RT_MANIFEST`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x852`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.06188`
MD5	`4cf1d34553f5e151ad09bc268566e410`
SHA1	`a131e88742cffc5f29dfbbd372187ef1fb65f4c6`
SHA256	`f3538965053f079e31c0fe932c37a5f7b9cd8be9fb662c3ed3aede9dcd4273ff`
SHA3	`3b56cd6ee16873b7d9677acd119d13c0d13a409baaa65ce61b057adf301930e3`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	1.0.0.0
ProductVersion	1.0.0.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	UNKNOWN
CompanyName	Avaya Inc.
FileDescription	setup
FileVersion (#2)	1.0.0.0
InternalName	setup.exe
LegalCopyright	Copyright Â© Avaya Inc. 2009
OriginalFilename	setup.exe
ProductName	setup
ProductVersion (#2)	1.0.0.0
Assembly Version	1.0.0.0

Resource LangID	UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.