Manalyze report for 397a7374cff9b23f9ddabfd0d36ff71a20cff46f6df57eb929f6c1dd7842fc7f

This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2044-Feb-16 12:57:07
Comments	The finest Windows Optimizer CLI
CompanyName	deadmoon Â© â
FileDescription	OptimizerNXT
FileVersion	`0.0.0.0`
InternalName	optimizerNXT.exe
LegalCopyright	deadmoon Â© â
LegalTrademarks
OriginalFilename	optimizerNXT.exe
ProductName	OptimizerNXT
ProductVersion	`0.0.0.0`
Assembly Version	0.0.0.0

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C# v7.0 / Basic .NET` `.NET executable -> Microsoft`
Suspicious	Strings found in the binary may indicate undesirable behavior:	`Contains references to system / monitoring tools: regedit.exe` `Contains references to security software: rshell.exe` `May have dropper capabilities: CurrentControlSet\Services CurrentVersion\Run Programs\Startup` `Contains another PE executable: This program cannot be run in DOS mode.` `Miscellaneous malware strings: cmd.exe` `Contains domain names: github.com githubusercontent.com https://github.com https://raw.githubusercontent.com https://raw.githubusercontent.com/hellzerg/optimizerNXT/refs/heads/main/version.txt https://www.paypal.com https://www.paypal.com/paypalme/supportoptimizer paypal.com raw.githubusercontent.com www.paypal.com`
Malicious	VirusTotal score: 4/69 (Scanned on 2026-07-15 09:55:34)	`CrowdStrike: win/malicious_confidence_70% (W)` `Cylance: Unsafe` `MaxSecure: Trojan.Malware.300983.susgen` `TrendMicro-HouseCall: Trojan.MSIL.Gen.TL0101EA26ZM`

Hashes

MD5	`7a049fb1a79dfe0612e397024da3a7e9`
SHA1	`2acd4df626aa1c65d919b096c09cc3b69f0f89eb`
SHA256	`397a7374cff9b23f9ddabfd0d36ff71a20cff46f6df57eb929f6c1dd7842fc7f`
SHA3	`acaca135f4e0bd676cd68d89443de86759ec5048605158ad05cc9e600e288100`
SSDeep	`6144:E5QV0RbPz4/wI8JWGC+OaVWzQEQzwf/U+POni6ocIaVaB8Z1K1Y9W2jtYr:Kj2/wI8JW71aszQEQzw9POni6ocIaVE`
Imports Hash	`f34d5f2d4577ed6d9ceec516c1f5a744`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`3`
TimeDateStamp	2044-Feb-16 12:57:07
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`48.0`
SizeOfCode	`0x53400`
SizeOfInitializedData	`0x2200`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0005532E (Section: .text)`
BaseOfCode	`0x2000`
BaseOfData	`0x56000`
ImageBase	`0x400000`
SectionAlignment	`0x2000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x5a000`
SizeOfHeaders	`0x200`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NO_SEH` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`e1989cc3c1acf0f2b2c468f1925c9c21`
SHA1	`3343e335322d0559a4caf5a6810bd7a443fd6db2`
SHA256	`d001422343404b91ef40d1b0fa764309d18a013d9a19b8d46c370da9252832b0`
SHA3	`e4f4587de25b4aedb875689a8d41973dd07fc625f2bbbf6680083292db4221b0`
VirtualSize	`0x53334`
VirtualAddress	`0x2000`
SizeOfRawData	`0x53400`
PointerToRawData	`0x200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`5.993`

.rsrc

MD5	`829399c03c081f4a0924ff7c7d3e0e83`
SHA1	`0710b2d470e91946e77490fd2c165a49a6622939`
SHA256	`8450fb4277dc7ebf272b02c5321fc22256ba1fb593603b40828a97f210826de4`
SHA3	`d1ecdfc078a428d41a583cfc5895f5c122f7886b611387810648374096f4d127`
VirtualSize	`0x1ef4`
VirtualAddress	`0x56000`
SizeOfRawData	`0x2000`
PointerToRawData	`0x53600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`7.26144`

.reloc

MD5	`8baddc3ef267897238a8a2cb288602d6`
SHA1	`0d54d8fff3e9a040544416ff14d4adb02c4c1f07`
SHA256	`0adc3d430502074df603bee0406c61ea50fcb28ac1d899f78125b91382aced15`
SHA3	`5603e546eb3e934addd8973c71eb0fdee45af73a0a0e32da1cfad211a69e0628`
VirtualSize	`0xc`
VirtualAddress	`0x58000`
SizeOfRawData	`0x200`
PointerToRawData	`0x55600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.10191`

Imports

mscoree.dll	`_CorExeMain`

Delayed Imports

1

Type	`RT_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x1832`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.84503`
Detected Filetype	PNG graphic file
MD5	`d235199ae418dda40844332039e5cd13`
SHA1	`64769c9d1db41fa185e48f3c46d1a4aa182ff357`
SHA256	`c72b1dcc2a128540f62f51b0544ac0ad7c488c6cca8d1c10d2914d6e63f507e7`
SHA3	`f98eff774b401079f15b8114e073b4da6ce693b5a19ef428ccee957ce48a274d`

32512

Type	`RT_GROUP_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x14`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`1.51664`
Detected Filetype	Icon file
MD5	`ac1fd7e5c2584e3dc2fcb9bc375d79cd`
SHA1	`0ef148c48e2bb5552a4a5cf8c0323a689998d604`
SHA256	`d1abd140a2dcc693adc109ca14037899e54285f6fc9e50954e0fe3b726b2b624`
SHA3	`ff901794051ddc81f5acde5873f516a9adf6154f58ed22fc0da1aeb5b31788ab`

1 (#2)

Type	`RT_VERSION`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x38c`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.30808`
MD5	`a9802f3dfa389d18bb8e6d0b9eb9f200`
SHA1	`663bca6703a1b55f39cafd6da607572b367d967c`
SHA256	`7f903ab9e02ee1df2fc0053f09dafd0734470b4c41741923ef3f43fb645fea7d`
SHA3	`120bde94e1d47f5947e3409e3e766f20657f056d4f79f792a17af109989c7d6c`

1 (#3)

Type	`RT_MANIFEST`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x1ea`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.00112`
MD5	`b7db84991f23a680df8e95af8946f9c9`
SHA1	`cac699787884fb993ced8d7dc47b7c522c7bc734`
SHA256	`539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a`
SHA3	`4f72877413d13a67b52b292a8524e2c43a15253c26aaf6b5d0166a65bc615cff`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	0.0.0.0
ProductVersion	0.0.0.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	UNKNOWN
Comments	The finest Windows Optimizer CLI
CompanyName	deadmoon Â© â
FileDescription	OptimizerNXT
FileVersion (#2)	0.0.0.0
InternalName	optimizerNXT.exe
LegalCopyright	deadmoon Â© â
LegalTrademarks
OriginalFilename	optimizerNXT.exe
ProductName	OptimizerNXT
ProductVersion (#2)	0.0.0.0
Assembly Version	0.0.0.0

Resource LangID	UNKNOWN

UNKNOWN

Characteristics	`0`
TimeDateStamp	1970-Jan-01 00:00:00
Version	`0.0`
SizeofData	`0`
AddressOfRawData	`0`
PointerToRawData	`0`

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.