31fabc69d5e397b3b290a8f0b0329497
This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2092-Jul-03 21:44:46 |
| Debug artifacts |
C:\Java\Projects\Project WALLED\GTTrainer\obj\x64\Debug\Project WALLED.pdb
|
| Comments | |
| CompanyName | |
| FileDescription | Project WALLED |
| FileVersion | 1.0.0.4 |
| InternalName | Project WALLED.exe |
| LegalCopyright | Copyright © 2020 |
| LegalTrademarks | |
| OriginalFilename | Project WALLED.exe |
| ProductName | Growtopia Trainer |
| ProductVersion | 1.0.0.4 |
| Assembly Version | 1.0.0.0 |
Plugin Output
| Info | Matching compiler(s): | .NET executable -> Microsoft |
| Malicious | VirusTotal score: 10/70 (Scanned on 2021-02-09 21:30:55) |
Malwarebytes:
Malware.AI.3655145039
Sangfor: Trojan.Win32.Save.a APEX: Malicious Sophos: Generic ML PUA (PUA) FireEye: Generic.mg.31fabc69d5e397b3 Ikarus: Trojan.Diztakun Microsoft: Program:Win32/Wacapew.C!ml Cynet: Malicious (score: 100) Cylance: Unsafe SentinelOne: Static AI - Malicious PE |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 3 |
| TimeDateStamp | 2092-Jul-03 21:44:46 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 48.0 |
| SizeOfCode | 0x665400 |
| SizeOfInitializedData | 0x668c00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000667262 (Section: .text) |
| BaseOfCode | 0x2000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x66e000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rsrc
.reloc
Imports
| mscoree.dll |
_CorExeMain
|
|---|
Delayed Imports
1
32512
1 (#2)
1 (#3)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.0.0.4 |
| ProductVersion | 1.0.0.4 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| Comments | |
| CompanyName | |
| FileDescription | Project WALLED |
| FileVersion (#2) | 1.0.0.4 |
| InternalName | Project WALLED.exe |
| LegalCopyright | Copyright © 2020 |
| LegalTrademarks | |
| OriginalFilename | Project WALLED.exe |
| ProductName | Growtopia Trainer |
| ProductVersion (#2) | 1.0.0.4 |
| Assembly Version | 1.0.0.0 |
| Resource LangID | UNKNOWN |
|---|
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2039-Apr-27 16:11:40 |
| Version | 0.0 |
| SizeofData | 99 |
| AddressOfRawData | 0x667290 |
| PointerToRawData | 0x665490 |
| Referenced File | C:\Java\Projects\Project WALLED\GTTrainer\obj\x64\Debug\Project WALLED.pdb |