Manalyze report for 29a9a316366173b0f2d129591ad8f8d13c199d4ca910abf54ad677a620bad07e

This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2026-Aug-05 17:03:58
FileDescription
FileVersion	`0.0.0.0`
InternalName	Archon.exe
LegalCopyright
OriginalFilename	Archon.exe
ProductVersion	`0.0.0.0`
Assembly Version	0.0.0.0

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C# v7.0 / Basic .NET`
Info	Interesting strings found in the binary:	Contains domain names: assetgame.roblox.com auth.roblox.com github.com https://assetgame.roblox.com https://assetgame.roblox.com/game/PlaceLauncher.ashx https://auth.roblox.com https://auth.roblox.com/v1/authentication-ticket/ https://github.com https://thumbnails.roblox.com https://thumbnails.roblox.com/v1/users/avatar-headshot?userIds https://users.roblox.com https://users.roblox.com/v1/users/authenticated https://www.roblox.com https://www.roblox.com/ https://www.tiktok.com https://www.tiktok.com/ roblox.com thumbnails.roblox.com tiktok.com users.roblox.com www.roblox.com www.tiktok.com
Malicious	VirusTotal score: 12/52 (Scanned on 2026-08-07 12:53:19)	`APEX: Malicious` `Bkav: W32.Malware.FB3A1F5E` `CrowdStrike: win/malicious_confidence_90% (D)` `Cylance: Unsafe` `Elastic: malicious (high confidence)` `Kingsoft: malware.kb.c.963` `MaxSecure: Trojan.Malware.300983.susgen` `Microsoft: Trojan:Win32/Wacatac.C!ml` `Paloalto: generic.ml` `Trapmine: malicious.high.ml.score` `TrendMicro-HouseCall: Trojan.Win32.VSX.PE04CA5` `VirIT: Trojan.Win32.MSIL_Heur.A`

Hashes

MD5	`68ecd6fef1bea9a2a1d15913791706ac`
SHA1	`465ccd3bbda9f2c60c1115b5d3b1b752933dd47a`
SHA256	`29a9a316366173b0f2d129591ad8f8d13c199d4ca910abf54ad677a620bad07e`
SHA3	`3ed43e3906477d896217256e5b940a19371dba90699a9afa1b7d6d4214c37c32`
SSDeep	`1536:iHiLswCsKxhLklqtsxcv1UdHnKLahvxLt65Ny2X6CqdImt:JShYBcvGJv5QNy7dIc`
Imports Hash	`f34d5f2d4577ed6d9ceec516c1f5a744`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`3`
TimeDateStamp	2026-Aug-05 17:03:58
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`11.0`
SizeOfCode	`0x18400`
SizeOfInitializedData	`0x800`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0001A28E (Section: .text)`
BaseOfCode	`0x2000`
BaseOfData	`0x1c000`
ImageBase	`0x400000`
SectionAlignment	`0x2000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`4.0`
Win32VersionValue	`0`
SizeOfImage	`0x20000`
SizeOfHeaders	`0x200`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_NO_SEH` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`906b450d6e1bd8d860e4cf2ba28977e2`
SHA1	`a80eb591d1b5eb306760bf8bc5f03f37080fa3d2`
SHA256	`b9b69a8efd86966d350f3eace9bfd027476c9b790a254a804916e9fe169ed139`
SHA3	`17127f7dde5d1191f0352689d42248125cbdb3e97623c28f38ea98bec22c7423`
VirtualSize	`0x18294`
VirtualAddress	`0x2000`
SizeOfRawData	`0x18400`
PointerToRawData	`0x200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`5.69621`

.rsrc

MD5	`b622791527e17470aada2ab41f6f4a44`
SHA1	`dd767867bee5dc28c782bb0fa88877ccf586741b`
SHA256	`3a7448f9c1c122ec58a0375bc04e737642bb42e4aae34760d3a36d5998f03f61`
SHA3	`168123cd1b4d4ad70cb712270da3d2d927ef37447443d6dad328749da4825944`
VirtualSize	`0x4d8`
VirtualAddress	`0x1c000`
SizeOfRawData	`0x600`
PointerToRawData	`0x18600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`3.70799`

.reloc

MD5	`a774317f1d90c8c34f5742fe8d012a76`
SHA1	`abdf2501be77526892bd5570843b6b6ff7d1e8e4`
SHA256	`aae838c07f510d43e2d8497c5aff2d094be187c34093f324d4035d6ac78d192e`
SHA3	`8831e89924462ec6fd5965d4b40fdfe3f485843a152cbc1fc23303c5e3f731eb`
VirtualSize	`0xc`
VirtualAddress	`0x1e000`
SizeOfRawData	`0x200`
PointerToRawData	`0x18c00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.10191`

Imports

mscoree.dll	`_CorExeMain`

Delayed Imports

1

Type	`RT_VERSION`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x244`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.14952`
MD5	`13dfce3434443e03f9b80a3e5b6dc335`
SHA1	`4edbdd36c63d46431aaf53afe0b752a5aa850367`
SHA256	`11277604b4fda30aefb3af01fccf418580bfbb405249fb386c41f621433b52bd`
SHA3	`05c933ca4c65e26095171290e4e1eb1319c26beb367cb5b55be3f6b50b672abf`

1 (#2)

Type	`RT_MANIFEST`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x1ea`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.00112`
MD5	`a19a2658ba69030c6ac9d11fd7d7e3c1`
SHA1	`879dcf690e5bf1941b27cf13c8bcf72f8356c650`
SHA256	`c0085eb467d2fc9c9f395047e057183b3cd1503a4087d0db565161c13527a76f`
SHA3	`93cbaf236d2d3870c1052716416ddf1c34f21532e56dd70144e9a01efcd0ce34`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	0.0.0.0
ProductVersion	0.0.0.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	UNKNOWN
FileDescription
FileVersion (#2)	0.0.0.0
InternalName	Archon.exe
LegalCopyright
OriginalFilename	Archon.exe
ProductVersion (#2)	0.0.0.0
Assembly Version	0.0.0.0

Resource LangID	UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.