2226b8a2ac6e61dd5bc5327d48c74e1c
This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2076-Dec-13 15:55:54 |
| Debug artifacts |
umXx.pdb
|
| Comments | |
| CompanyName | Microsoft Corporation |
| FileDescription | Unload PerfMon |
| FileVersion | 1.0.0.0 |
| InternalName | umXx.exe |
| LegalCopyright | Copyright © Microsoft Corporation. All rights reserved. |
| LegalTrademarks | |
| OriginalFilename | umXx.exe |
| ProductName | Unload PerfMon |
| ProductVersion | 1.0.0.0 |
| Assembly Version | 1.0.0.0 |
Plugin Output
| Info | Matching compiler(s): | Microsoft Visual C# v7.0 / Basic .NET |
| Malicious | VirusTotal score: 58/75 (Scanned on 2024-07-26 18:06:59) |
ALYac:
Trojan.GenericKD.73342723
APEX: Malicious AVG: Win32:PWSX-gen [Trj] AhnLab-V3: Trojan/Win.PWSX-gen.C5646936 Alibaba: TrojanPSW:MSIL/Agensla.0c3ce4dd Arcabit: Trojan.Generic.D45F1F03 Avast: Win32:PWSX-gen [Trj] Avira: TR/AD.GenSteal.spunn BitDefender: Trojan.GenericKD.73342723 Bkav: W32.AIDetectMalware.CS CrowdStrike: win/malicious_confidence_90% (W) Cybereason: malicious.2ac6e6 Cylance: Unsafe DeepInstinct: MALICIOUS DrWeb: Trojan.PackedNET.2962 ESET-NOD32: a variant of MSIL/Kryptik.ALWJ Elastic: malicious (high confidence) Emsisoft: Trojan.GenericKD.73342723 (B) F-Secure: Trojan.TR/AD.GenSteal.spunn FireEye: Trojan.GenericKD.73342723 Fortinet: MSIL/Kryptik.AJAP!tr GData: Trojan.GenericKD.73342723 Google: Detected Ikarus: Trojan.MSIL.Inject K7AntiVirus: Riskware ( 00584baa1 ) K7GW: Riskware ( 00584baa1 ) Kaspersky: HEUR:Trojan-PSW.MSIL.Agensla.gen Kingsoft: MSIL.Trojan-PSW.Agensla.gen Lionic: Trojan.Win32.Agensla.i!c MAX: malware (ai score=83) Malwarebytes: Trojan.MalPack.PNG.Generic MaxSecure: Trojan.Malware.74499699.susgen McAfee: Artemis!2226B8A2AC6E McAfeeD: ti!72629B026D16 MicroWorld-eScan: Trojan.GenericKD.73342723 Microsoft: Trojan:Win32/Leonem Paloalto: generic.ml Panda: Trj/Chgt.AD Rising: Malware.Obfus/MSIL@AI.98 (RDM.MSIL2:L8zbUUM3C5tmTW2rAv0/Lg) Sangfor: Trojan.Win32.Save.MSIL_Inject SentinelOne: Static AI - Suspicious PE Skyhigh: BehavesLike.Win32.Generic.dc Sophos: Troj/Krypt-ABH Symantec: Trojan.Gen.MBT Tencent: Malware.Win32.Gencirc.1412f742 Trapmine: malicious.moderate.ml.score TrendMicro: TrojanSpy.Win32.NEGASTEAL.YXEGCZ TrendMicro-HouseCall: TrojanSpy.Win32.NEGASTEAL.YXEGCZ VBA32: TScope.Trojan.MSIL VIPRE: Trojan.GenericKD.73342723 Varist: W32/MSIL_Kryptik.KPV.gen!Eldorado VirIT: Trojan.Win32.MSIL.GYX Xcitium: Malware@#25wjaj257nzao Yandex: Trojan.Igent.b2zR5a.7 Zillya: Trojan.Kryptik.Win32.4826694 ZoneAlarm: HEUR:Trojan-PSW.MSIL.Agensla.gen alibabacloud: Trojan[stealer]:MSIL/Agensla.gyf huorong: Trojan/Generic!12391826F0979FC1 |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2076-Dec-13 15:55:54 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 48.0 |
| SizeOfCode | 0xe3c00 |
| SizeOfInitializedData | 0x6600 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x000E5ACE (Section: .text) |
| BaseOfCode | 0x2000 |
| BaseOfData | 0xe6000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xf0000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rsrc
.reloc
Imports
| mscoree.dll |
_CorExeMain
|
|---|
Delayed Imports
1
2
3
4
5
6
7
8
32512
1 (#2)
1 (#3)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.0.0.0 |
| ProductVersion | 1.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| Comments | |
| CompanyName | Microsoft Corporation |
| FileDescription | Unload PerfMon |
| FileVersion (#2) | 1.0.0.0 |
| InternalName | umXx.exe |
| LegalCopyright | Copyright © Microsoft Corporation. All rights reserved. |
| LegalTrademarks | |
| OriginalFilename | umXx.exe |
| ProductName | Unload PerfMon |
| ProductVersion (#2) | 1.0.0.0 |
| Assembly Version | 1.0.0.0 |
| Resource LangID | UNKNOWN |
|---|
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2090-Sep-27 04:24:11 |
| Version | 256.20557 |
| SizeofData | 33 |
| AddressOfRawData | 0xe3dc8 |
| PointerToRawData | 0xe1fc8 |
| Referenced File | umXx.pdb |
UNKNOWN
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 1.0 |
| SizeofData | 39 |
| AddressOfRawData | 0xe3de9 |
| PointerToRawData | 0xe1fe9 |
UNKNOWN (#2)
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| SizeofData | 0 |
| AddressOfRawData | 0 |
| PointerToRawData | 0 |
UNKNOWN (#3)
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 256.256 |
| SizeofData | 7273 |
| AddressOfRawData | 0xe3e10 |
| PointerToRawData | 0xe2010 |