29898550f4523387aced5dbd23b5931715b8570594926892000100c4154b5a33
This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2025-May-01 13:55:13 |
| Detected languages |
English - United States
|
Plugin Output
| Info | Matching compiler(s): |
Microsoft Visual C# v7.0 / Basic .NET
.NET executable -> Microsoft |
| Malicious | VirusTotal score: 23/70 (Scanned on 2026-08-04 06:30:36) |
APEX:
Malicious
Antiy-AVL: GrayWare/Win32.Wacapew CTX: exe.trojan.pomal CrowdStrike: win/malicious_confidence_70% (D) DeepInstinct: MALICIOUS Elastic: malicious (high confidence) Fortinet: PossibleThreat Google: Detected Kingsoft: malware.kb.c.994 Lionic: Trojan.Win32.Pomal.4!c MaxSecure: Trojan.Malware.325188728.susgen Microsoft: Trojan:Win32/Pomal!rfn Sangfor: Trojan.Win32.Agent.Vnci SentinelOne: Static AI - Suspicious PE Sophos: ML/PE-A Symantec: ML.Attribute.HighConfidence Trapmine: malicious.moderate.ml.score TrellixENS: Artemis!E160F316406C TrendMicro: Trojan.MSIL.POMAL.TL0101G726ZZ TrendMicro-HouseCall: Trojan.Win32.VSX.PE04CA5 Varist: W32/ABTrojan.QKPM-8200 Webroot: W32.Malware.gen alibabacloud: Trojan:Win/Pomal.Gen |
Hashes
| MD5 | e160f316406cf702b4157d0d398f7086 🔍 |
|---|---|
| SHA1 | d027e848ac3749ab8e87ba05069e0851e0c49f49 🔍 |
| SHA256 | 29898550f4523387aced5dbd23b5931715b8570594926892000100c4154b5a33 🔍 |
| SHA3 | d3da83efddf090c8b9f1f2dab1887d8e831346dc0c70a33d20fdca85e2ad1371 🔍 |
| SSDeep | 768:3iXbVRb5f81pCp9R+hR6CI5wQsOMtxSKk1Fgfb6jcxdbDJYVNmNI43Nv9LENPLE:3uVp5f81pCp9R+hR6CI5wQsOMtxSKk1 🔍 |
| Imports Hash | f34d5f2d4577ed6d9ceec516c1f5a744 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2025-May-01 13:55:13 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 11.0 |
| SizeOfCode | 0x4200 |
| SizeOfInitializedData | 0x2a00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000604E (Section: .text) |
| BaseOfCode | 0x2000 |
| BaseOfData | 0x8000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xe000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
| MD5 | a74acf38b7e08829f46479139a0c8c66 🔍 |
|---|---|
| SHA1 | 91b74ed9eb6100148391f5e7da05fbe2570a50e2 🔍 |
| SHA256 | dd23b0329654fac4a7a5668211d4bb7a2aec90284183fe5eae08d23efa6488b8 🔍 |
| SHA3 | c15faf4fb80daf5917114d9e806745a4e213bfe0ff794cb781b0ee43586e9ec6 🔍 |
| VirtualSize | 0x4054 |
| VirtualAddress | 0x2000 |
| SizeOfRawData | 0x4200 |
| PointerToRawData | 0x200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 3.68747 |
.rsrc
| MD5 | bd26824b3a9dbc2baf97f950adb932ec 🔍 |
|---|---|
| SHA1 | b8e49a8df478e3d3f5ecb53f6a5c4e0858196e77 🔍 |
| SHA256 | fb4e9a16f7f9c6ef2059e2dbcb85cfc93789c38779d5cb15f014f91e76d5ac39 🔍 |
| SHA3 | e7bdf993c474f5516c9a1150b932b3f121bf7c24c5fafdcbad3d5ec82cee9832 🔍 |
| VirtualSize | 0x2674 |
| VirtualAddress | 0x8000 |
| SizeOfRawData | 0x2800 |
| PointerToRawData | 0x4400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 4.42156 |
.reloc
| MD5 | d5e855a9aa97b858958d430bd9fdb3e4 🔍 |
|---|---|
| SHA1 | 4c91044b7c1938629194607eef6f8b5ddddf7ad8 🔍 |
| SHA256 | 2915c5966537b5b2c52b904012526171cca82ceaca06b6ff11edf359892fd77e 🔍 |
| SHA3 | 0ec6aafdc029a10dacbbf38deb928b8cc68418dcf55b8246c8a721a52bdddf4d 🔍 |
| VirtualSize | 0xc |
| VirtualAddress | 0xc000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x6c00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 0.0815394 |
Imports
| mscoree.dll |
_CorExeMain
|
|---|
Delayed Imports
1
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x25a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.57469 |
| MD5 | d9bad3f607f17c83bba3a18b2c3739cf 🔍 |
| SHA1 | 84e8464c7e0bcdc968be113d4055c09fdb663293 🔍 |
| SHA256 | 858d3cf7f5cd68737662086029d8a03cf60f36e9ec203f999ce824cbaae8df49 🔍 |
| SHA3 | 1ecca5ab24475e25a0838b47a53eb138739125a73e00eaf34c89a58124491cb8 🔍 |
IDI_ICON1
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x14 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 1.91924 |
| Detected Filetype | Icon file |
| MD5 | 6da8e7d5ae1d5d15e0230a67a7c16c6d 🔍 |
| SHA1 | 678db52cbe5d617c33c6269bfd4b6d8d1a17f956 🔍 |
| SHA256 | 6eb54801f91b6d8effccbfaefe6b2d7705a274a75940e6226e24e0d4ec58c396 🔍 |
| SHA3 | 994fc217c7b8bc8008ac262ff58044403206de6eceafd424d4640ecad395eb2f 🔍 |
Version Info
TLS Callbacks
Load Configuration
RICH Header
Errors
Leave a comment
No comments yet.