×
This file seems to be a .NET executable .
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Architecture
IMAGE_FILE_MACHINE_I386
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date
2096-May-21 02:23:19
Debug artifacts
D:\PROJELER\Biten Projeler\EASYSOFT - Diyarbakır\YEDEKLEME\easycloud\easycloud\BoysisBackup\obj\Debug\easycloud.pdb
Comments
CompanyName
FileDescription
easycloud
FileVersion
1.0.0.0
InternalName
easycloud.exe
LegalCopyright
Copyright © 2023
LegalTrademarks
OriginalFilename
easycloud.exe
ProductName
easycloud
ProductVersion
1.0.0.0
Assembly Version
1.0.0.0
Info
Matching compiler(s):
Microsoft Visual C# v7.0 / Basic .NET
Suspicious
Strings found in the binary may indicate undesirable behavior:
May have dropper capabilities:
Contains domain names:
cihanoz.com
easysoft.com
hotmail.com
http://icanhazip.com
http://www.easysoft.com.tr
http://www.easysoft.com.tr'
https://easysoft.com.tr
https://easysoft.com.tr/
https://www.iletimerkezi.com
https://www.iletimerkezi.com/panel/auth/signup/
icanhazip.com
iletimerkezi.com
inkscape.org
smslogin.nac.com
smtp.yandex.com
www.easysoft.com
www.iletimerkezi.com
www.inkscape.org
yandex.com
Malicious
VirusTotal score: 3/72 (Scanned on 2024-10-01 19:33:04)
CrowdStrike:
win/malicious_confidence_60% (D)
MaxSecure:
Trojan.Malware.300983.susgen
VirIT:
Trojan.Win32.MSIL_Heur.A
MD5
2df08e97287ace8340e0a1ba886c6bd1
SHA1
4c80afd5efba50bd3038f89f01dd1208e1919271
SHA256
926b719379c304373ef3334f49a8f97886a168a5a1d975fd7411f4c9f8fc8793
SHA3
720077f99006057af2017b51721a293595b0a02de22918262940f63311829310
SSDeep
12288:5Bp/Aw7F2igSB4E5lgBp/Aw7F28KeeFugSB4E0Bp/Aw7F2MBp/Aw7F2tf7p/Aw7:5LX9BHgL5mu9BwL9LsZ
Imports Hash
f34d5f2d4577ed6d9ceec516c1f5a744
e_magic
MZ
e_cblp
0x90
e_cp
0x3
e_crlc
0
e_cparhdr
0x4
e_minalloc
0
e_maxalloc
0xffff
e_ss
0
e_sp
0xb8
e_csum
0
e_ip
0
e_cs
0
e_ovno
0
e_oemid
0
e_oeminfo
0
e_lfanew
0x80
Signature
PE
Machine
IMAGE_FILE_MACHINE_I386
NumberofSections
3
TimeDateStamp
2096-May-21 02:23:19
PointerToSymbolTable
0
NumberOfSymbols
0
SizeOfOptionalHeader
0xe0
Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Magic
PE32
LinkerVersion
48.0
SizeOfCode
0x9d400
SizeOfInitializedData
0xf800
SizeOfUninitializedData
0
AddressOfEntryPoint
0x0009F28E (Section: .text)
BaseOfCode
0x2000
BaseOfData
0xa0000
ImageBase
0x400000
SectionAlignment
0x2000
FileAlignment
0x200
OperatingSystemVersion
4.0
ImageVersion
0.0
SubsystemVersion
6.0
Win32VersionValue
0
SizeOfImage
0xb2000
SizeOfHeaders
0x200
Checksum
0
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve
0x100000
SizeofStackCommit
0x1000
SizeofHeapReserve
0x100000
SizeofHeapCommit
0x1000
LoaderFlags
0
NumberOfRvaAndSizes
16
MD5
a1f6416bcdd183bd155f93821d928e29
SHA1
5f16859926f5a3272f785a444e4d6a3ea0eb460f
SHA256
f3c3b8e09c4576803a7696ddb158b8823b254a5d9c70ef2f815e4c73bc5ea952
SHA3
0a60d2a6d6d245630c98303576fbfe0210abfe859b49f37c03bff14ae6d98204
VirtualSize
0x9d294
VirtualAddress
0x2000
SizeOfRawData
0x9d400
PointerToRawData
0x200
PointerToRelocations
0
PointerToLineNumbers
0
NumberOfLineNumbers
0
NumberOfRelocations
0
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy
7.38344
MD5
5dd4705c65fc9d9a3b8b53ab56ad7f39
SHA1
1a35fbba2079a10e7e9cfff58272552167ad3aab
SHA256
b29e00a4bf80e8a7225b3af3ed36e0abe682d8e8a8c0fbd91d4d9e70df101952
SHA3
5282bbdaca0f68fe160746f59923011d9c2571b8130fb6156d35ddcec7e60fc9
VirtualSize
0xf4ac
VirtualAddress
0xa0000
SizeOfRawData
0xf600
PointerToRawData
0x9d600
PointerToRelocations
0
PointerToLineNumbers
0
NumberOfLineNumbers
0
NumberOfRelocations
0
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy
7.17423
MD5
73c6358bdf9cbacd89e74168c6e9216a
SHA1
2cd1dbebdb0a4e20f1c84bf205c7de41d41fe328
SHA256
d4d256d442316a58b270b53b583c34fbd23bcd771f9fee6d79a8a73e6969c2dd
SHA3
4131348db2bc2ec16a6f0675b60e953d855043dce2c9f703c85919f87dfee988
VirtualSize
0xc
VirtualAddress
0xb0000
SizeOfRawData
0x200
PointerToRawData
0xacc00
PointerToRelocations
0
PointerToLineNumbers
0
NumberOfLineNumbers
0
NumberOfRelocations
0
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy
0.10191
Type
RT_ICON
Language
UNKNOWN
Codepage
UNKNOWN
Size
0x468
TimeDateStamp
1980-Jan-01 00:00:00
Entropy
5.04376
MD5
8af8b0fa71ae36a7e3e99a8b65caeef3
SHA1
4a722af2c8801da428e903ac4baaabbbdcce5909
SHA256
6bff5073bbc9752e22ad8653e02f3317f3e66ecb17f033820ee5e6f3434ed314
SHA3
b10209482f35a2318e596bd019b751442934b39ba13a920f2386e218abbcd21f
Type
RT_ICON
Language
UNKNOWN
Codepage
UNKNOWN
Size
0x988
TimeDateStamp
1980-Jan-01 00:00:00
Entropy
4.66671
MD5
05cb999385859c91607f53bced311202
SHA1
6b985cdc16b04a22c76442fbeed91daff4f890c8
SHA256
a824e1faadffd65b8ca7b7872cc7f054fc7d92f215531df33c89401897a2110f
SHA3
9c1b9de5056aa31b25452cdda9dae78d7ee2cc84507cf83ba9ee62704bf93a49
Type
RT_ICON
Language
UNKNOWN
Codepage
UNKNOWN
Size
0x10a8
TimeDateStamp
1980-Jan-01 00:00:00
Entropy
4.21572
MD5
abd932086576c6508e8126b593554fdc
SHA1
4d18bc3c4b491cb5218e10c7c859417c047481cf
SHA256
8a786e438d8e9726ad2f46368a6d3850d66a6914223d90b275a85be254baadb8
SHA3
f31d78e4d7a650ffaf6e74b6237646ef68080399d409a16475b2deb1ae5f00a3
Type
RT_ICON
Language
UNKNOWN
Codepage
UNKNOWN
Size
0x25a8
TimeDateStamp
1980-Jan-01 00:00:00
Entropy
3.7621
MD5
ede3a59d10b11b71ba25b25f147addb9
SHA1
d1c2fc21ca72b688307852b344f34ca4e2e7ad89
SHA256
2bc69c6962e063409964540499bf7b4ca14947d09fdfdd3619f655daaf81d21a
SHA3
33e051028536b0406d552e1f1626e6ee4e7dd42d7d217c4feba8e40fbdfcf310
Type
RT_ICON
Language
UNKNOWN
Codepage
UNKNOWN
Size
0xa923
TimeDateStamp
1980-Jan-01 00:00:00
Entropy
7.97597
Detected Filetype
PNG graphic file
MD5
9c77e7128557b5455699522f306d2edf
SHA1
01c4849d50f6767f7bb6f3d7767ba9c6f6d02aa6
SHA256
be1119362bd39446f6da2fd1c806a52a1a2ae777d336abb07a8fbd7f9344d489
SHA3
51f774313ea502627901dc88a00be0617ca75ba842061b0b3da6fed4b3980873
Type
RT_GROUP_ICON
Language
UNKNOWN
Codepage
UNKNOWN
Size
0x4c
TimeDateStamp
1980-Jan-01 00:00:00
Entropy
2.64638
Detected Filetype
Icon file
MD5
062ec743133720c91dec67803467e7e3
SHA1
52bf91085cb63d45ec299d44fb39865158906082
SHA256
386dacabd8c26b08ecd00af27558bfa357002a0663ca82be269fb6d73ea2bd6b
SHA3
4a2bfec568f0d02fb6941f3940cf466c0766ddd9805e3101a4e19878a9065f2f
Type
RT_VERSION
Language
UNKNOWN
Codepage
UNKNOWN
Size
0x31c
TimeDateStamp
1980-Jan-01 00:00:00
Entropy
3.27573
MD5
ebd142515ec133d7aa837cc2b934e1dc
SHA1
592f5c12334a15788b29b24a1a530f27ffc0e971
SHA256
11f4faf0cfb2100ed97a6d6e881ec29600e994808c547f47fcb75df0b6bd80d4
SHA3
1ac1359b4530a508d1452def5f64bee35c50057b1226acf276742e9750670349
Type
RT_MANIFEST
Language
UNKNOWN
Codepage
UNKNOWN
Size
0x1ea
TimeDateStamp
1980-Jan-01 00:00:00
Entropy
5.00112
MD5
b7db84991f23a680df8e95af8946f9c9
SHA1
cac699787884fb993ced8d7dc47b7c522c7bc734
SHA256
539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a
SHA3
4f72877413d13a67b52b292a8524e2c43a15253c26aaf6b5d0166a65bc615cff
Signature
0xfeef04bd
StructVersion
0x10000
FileVersion
1.0.0.0
ProductVersion
1.0.0.0
FileFlags
(EMPTY)
FileOs
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType
VFT_APP
Language
UNKNOWN
Comments
CompanyName
FileDescription
easycloud
FileVersion (#2)
1.0.0.0
InternalName
easycloud.exe
LegalCopyright
Copyright © 2023
LegalTrademarks
OriginalFilename
easycloud.exe
ProductName
easycloud
ProductVersion (#2)
1.0.0.0
Assembly Version
1.0.0.0
Characteristics
0
TimeDateStamp
2061-Jun-22 05:04:55
Version
0.0
SizeofData
141
AddressOfRawData
0x9f1ac
PointerToRawData
0x9d3ac
Referenced File
D:\PROJELER\Biten Projeler\EASYSOFT - Diyarbakır\YEDEKLEME\easycloud\easycloud\BoysisBackup\obj\Debug\easycloud.pdb
Characteristics
0
TimeDateStamp
1970-Jan-01 00:00:00
Version
0.0
SizeofData
0
AddressOfRawData
0
PointerToRawData
0