27dc704e4e985569824077eaf8666193
This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2010-Dec-09 18:58:13 |
| Comments | |
| CompanyName | |
| FileDescription | EncWare |
| FileVersion | 1.0.0.0 |
| InternalName | EncWare.exe |
| LegalCopyright | Copyright © 2024 |
| LegalTrademarks | |
| OriginalFilename | EncWare.exe |
| ProductName | EncWare |
| ProductVersion | 1.0.0.0 |
| Assembly Version | 1.0.0.0 |
Plugin Output
| Info | Matching compiler(s): |
Microsoft Visual C# v7.0 / Basic .NET
.NET executable -> Microsoft |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Suspicious | The file contains overlay data. |
46782 bytes of data starting at offset 0x5800.
The overlay data has an entropy of 7.81882 and is possibly compressed or encrypted. |
| Malicious | VirusTotal score: 18/73 (Scanned on 2024-10-28 11:18:29) |
APEX:
Malicious
Bkav: W32.AIDetectMalware.CS CTX: exe.trojan.generic CrowdStrike: win/malicious_confidence_60% (D) Cylance: Unsafe DeepInstinct: MALICIOUS Elastic: malicious (high confidence) FireEye: Generic.mg.27dc704e4e985569 Fortinet: PossibleThreat Google: Detected Kingsoft: malware.kb.c.1000 Lionic: Trojan.Win32.Generic.4!c McAfee: Artemis!27DC704E4E98 SentinelOne: Static AI - Malicious PE Sophos: Generic ML PUA (PUA) Trapmine: malicious.high.ml.score Varist: W32/ABApplication.PRAY-7060 VirIT: Trojan.Win32.MSIL_Heur.A |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x40 |
| e_cp | 0x1 |
| e_crlc | 0 |
| e_cparhdr | 0x2 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0xb400 |
| e_oeminfo | 0xcd09 |
| e_lfanew | 0x40 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2010-Dec-09 18:58:13 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 8.0 |
| SizeOfCode | 0x1000 |
| SizeOfInitializedData | 0x800 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00002E5E (Section: .text) |
| BaseOfCode | 0x2000 |
| BaseOfData | 0x4000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xc000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rsrc
.reloc
Imports
| mscoree.dll |
_CorExeMain
|
|---|
Delayed Imports
1
2
3
32512
1 (#2)
1 (#3)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.0.0.0 |
| ProductVersion | 1.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| Comments | |
| CompanyName | |
| FileDescription | EncWare |
| FileVersion (#2) | 1.0.0.0 |
| InternalName | EncWare.exe |
| LegalCopyright | Copyright © 2024 |
| LegalTrademarks | |
| OriginalFilename | EncWare.exe |
| ProductName | EncWare |
| ProductVersion (#2) | 1.0.0.0 |
| Assembly Version | 1.0.0.0 |
| Resource LangID | UNKNOWN |
|---|