Manalyze report for 35f1edf67bd3dbaa8cafd4466eed7cda08e66d1817b693259361c1ea66eb44da

This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2017-Apr-24 15:20:21
Debug artifacts	D:\VisualStudioProjects\BIS\BIS_Tools\P3DDebinarizer\obj\Release\P3DDebinarizer.pdb
Comments
CompanyName
FileDescription	P3DDebinarizer
FileVersion	`1.5.0`
InternalName	P3DDebinarizer.exe
LegalCopyright	Copyright Â© 2016
LegalTrademarks
OriginalFilename	P3DDebinarizer.exe
ProductName	P3DDebinarizer
ProductVersion	`1.5.0`
Assembly Version	1.5.6323.31210

Plugin Output

Info	Matching compiler(s):	`.NET executable -> Microsoft`
Suspicious	VirusTotal score: 2/72 (Scanned on 2022-10-14 06:18:03)	`APEX: Malicious` `Trapmine: suspicious.low.ml.score`

Hashes

MD5	`e8a5602c43c3a24b3caee228d66bac16`
SHA1	`1b187096b740a1ce18fa45e09dfdd61821db27d6`
SHA256	`35f1edf67bd3dbaa8cafd4466eed7cda08e66d1817b693259361c1ea66eb44da`
SHA3	`7b91e8d8e4c82b8ef107a46a616ca2905e6c76f2d9ec4bb7e512de933b158247`
SSDeep	`1536:iC5y7xRuF4hHamuDGkNe0N1E69oAAAKqq90SNUCb66awGftsWCwnkV3R2REYoNc:tc1cwHamQ5HSN9bXSuH2RYNc`
Imports Hash	`f34d5f2d4577ed6d9ceec516c1f5a744`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`3`
TimeDateStamp	2017-Apr-24 15:20:21
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`48.0`
SizeOfCode	`0x1c400`
SizeOfInitializedData	`0x800`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0001E3D6 (Section: .text)`
BaseOfCode	`0x2000`
BaseOfData	`0x20000`
ImageBase	`0x400000`
SectionAlignment	`0x2000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x24000`
SizeOfHeaders	`0x200`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NO_SEH` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`ccc757cbe8997f5e55cfdeab96d73cec`
SHA1	`b6764f46c8c124f89b469fbb88ea79711268442c`
SHA256	`e4f9a1e9cfe80387aec10ce3d452b11f19ebf55af843c924462ccf1e7518bbe5`
SHA3	`a558fb0e928bac3ce9c8c0dafd6198fbd85d359137a8ad7afcb40be1a088f22a`
VirtualSize	`0x1c3e4`
VirtualAddress	`0x2000`
SizeOfRawData	`0x1c400`
PointerToRawData	`0x200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.2293`

.rsrc

MD5	`7fcbfc3d12e0dc18cc747c9f944522bb`
SHA1	`3053e6d9236c7c43ce2f6689aa72ec09d9352882`
SHA256	`4dd45b5a8436b40b49c8f06e11b31ba47388e0c496e0c09e5bbfed1de7eb7248`
SHA3	`609342faa0453d176b07553a7653376c703630a9362cf238f6f1ab5226e1e9fe`
VirtualSize	`0x5e4`
VirtualAddress	`0x20000`
SizeOfRawData	`0x600`
PointerToRawData	`0x1c600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.19408`

.reloc

MD5	`d7834eed0b2c00564dc68ac328038505`
SHA1	`7fa0babd5b38b9f14b45019c16e63830e06e1c19`
SHA256	`f689490fcdd3d32c9d74da1c68ed60d0caf855bb0c4b286feaf45ff87dbdef0d`
SHA3	`38774ae100bd14a7d6b9c17ae645ff664ccc9baf7b47a98056aaa0eb3354df4c`
VirtualSize	`0xc`
VirtualAddress	`0x22000`
SizeOfRawData	`0x200`
PointerToRawData	`0x1cc00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.10191`

Imports

mscoree.dll	`_CorExeMain`

Delayed Imports

1

Type	`RT_VERSION`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x352`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.31282`
MD5	`2cea2074f9f2ee7dd24c8f341fd7654b`
SHA1	`5a3efbce45ce8b71eac8562d914e72ba4e54f194`
SHA256	`3c63cdd33225aa28d23e3f11c7edd56dc5d95444d6fa810c39d0b9b0c7c8a0e4`
SHA3	`9999ad699dbb08d9dade6176ff541e17cd47491f8f8452a20375b6e66c88fe37`

1 (#2)

Type	`RT_MANIFEST`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x1ea`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.00112`
MD5	`b7db84991f23a680df8e95af8946f9c9`
SHA1	`cac699787884fb993ced8d7dc47b7c522c7bc734`
SHA256	`539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a`
SHA3	`4f72877413d13a67b52b292a8524e2c43a15253c26aaf6b5d0166a65bc615cff`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	1.5.0.0
ProductVersion	1.5.0.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	UNKNOWN
Comments
CompanyName
FileDescription	P3DDebinarizer
FileVersion (#2)	1.5.0
InternalName	P3DDebinarizer.exe
LegalCopyright	Copyright Â© 2016
LegalTrademarks
OriginalFilename	P3DDebinarizer.exe
ProductName	P3DDebinarizer
ProductVersion (#2)	1.5.0
Assembly Version	1.5.6323.31210

Resource LangID	UNKNOWN

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics	`0`
TimeDateStamp	2017-Apr-24 15:20:21
Version	`0.0`
SizeofData	`284`
AddressOfRawData	`0x1e268`
PointerToRawData	`0x1c468`
Referenced File	D:\VisualStudioProjects\BIS\BIS_Tools\P3DDebinarizer\obj\Release\P3DDebinarizer.pdb

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.