Manalyze report for 40126ae71b857dd22db39611c25d3d5dd0e60316b72830e930fba9baf23973ce

This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2020-Feb-03 13:09:54
Comments
CompanyName
FileDescription	VBCECompiler
FileVersion	`1.0.0.0`
InternalName	VBCECompiler.exe
LegalCopyright	Copyright © 2019
LegalTrademarks
OriginalFilename	VBCECompiler.exe
ProductName	VBCECompiler
ProductVersion	`1.0.0.0`
Assembly Version	1.0.0.0

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C# v7.0 / Basic .NET` `.NET executable -> Microsoft`
Suspicious	Strings found in the binary may indicate undesirable behavior:	`May have dropper capabilities: CurrentVersion\Run`
Malicious	VirusTotal score: 9/69 (Scanned on 2021-03-19 15:56:02)	`CAT-QuickHeal: Trojan.Wacatac` `McAfee: Artemis!E245F8D129E8` `APEX: Malicious` `Rising: Trojan.Zpevdo!8.F912 (CLOUD)` `AhnLab-V3: Malware/Win32.RL_Generic.C4139068` `BitDefenderTheta: Gen:NN.ZemsilF.34628.am0@aOxE04b` `Fortinet: PossibleThreat` `Webroot: W32.Malware.Gen` `CrowdStrike: win/malicious_confidence_80% (W)`

Hashes

MD5	`e245f8d129e8eadb00e165c569a14b71`
SHA1	`86447d6bcc862ebfa2366f751ce57de8b5948c9c`
SHA256	`40126ae71b857dd22db39611c25d3d5dd0e60316b72830e930fba9baf23973ce`
SHA3	`f32e9919024af327727bd053bfd588645db3a153f58f40ade1a95043461e62c8`
SSDeep	`48:6fkJXyuItwDAVmGVg27IzZSCCWJHcuwPONMqd+NRgR8MDkW29M9ITnAtPNGyi1t:AzMAVmrZdPRODod+NRgJcnAtVGNzNth`
Imports Hash	`f34d5f2d4577ed6d9ceec516c1f5a744`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`3`
TimeDateStamp	2020-Feb-03 13:09:54
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`48.0`
SizeOfCode	`0xe00`
SizeOfInitializedData	`0x800`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x00002D52 (Section: .text)`
BaseOfCode	`0x2000`
BaseOfData	`0x4000`
ImageBase	`0x400000`
SectionAlignment	`0x2000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x8000`
SizeOfHeaders	`0x200`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NO_SEH` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`f3170bbaae939f448faafdd168677508`
SHA1	`34a166eb41e8213b8c8b27cd95b740f177d70565`
SHA256	`2fd9468bc66b255dee433793e4c43b96a44f2701259e04bbb5e8482a40ad3615`
SHA3	`aa9d8fd3d9d8a25d9864061c8039d0a4967b79fd05800dac9e730a3ae9a7c95d`
VirtualSize	`0xd58`
VirtualAddress	`0x2000`
SizeOfRawData	`0xe00`
PointerToRawData	`0x200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`5.27508`

.rsrc

MD5	`8fb344d6665b9915bdd293c481d458e0`
SHA1	`79fa5c0c1dc1545818d0c609b57f6bdc161f36b0`
SHA256	`4091f3aa121ffb80c0a57ea25c9aad97d321a1af75021ee219bda5fde099f738`
SHA3	`46faa7d38723ae9630f599f62ef63b1d237fdeff679ca941521b5675d083f9fe`
VirtualSize	`0x5cc`
VirtualAddress	`0x4000`
SizeOfRawData	`0x600`
PointerToRawData	`0x1000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.11795`

.reloc

MD5	`e0c029390349b086f97b089d68764eb0`
SHA1	`8e8a34e225fca917ca6e3e7771467da4931d7eff`
SHA256	`d32bc8260a31cc3d5d4cdd1662d1e1309e5d5410a904a47ceb8120f66010826e`
SHA3	`621830964013ef15920550b9c10c668004d3d004e3b92d6e7128c3d730c7260a`
VirtualSize	`0xc`
VirtualAddress	`0x6000`
SizeOfRawData	`0x200`
PointerToRawData	`0x1600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.0815394`

Imports

mscoree.dll	`_CorExeMain`

Delayed Imports

1

Type	`RT_VERSION`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x33c`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.26279`
MD5	`a41cf6e664ab63db6124efb4e68ff354`
SHA1	`85af21adfc4d6ecf32cc8845f4637a6dde73047b`
SHA256	`915213f39aefa94459fb993287721052743016ceb199a4b4c415f8c03c3ed8bf`
SHA3	`80c4b03edda7ce25a5023e79cfb0a36a042aaa39b1310723e6bd67087f951771`

1 (#2)

Type	`RT_MANIFEST`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x1ea`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.00112`
MD5	`b7db84991f23a680df8e95af8946f9c9`
SHA1	`cac699787884fb993ced8d7dc47b7c522c7bc734`
SHA256	`539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a`
SHA3	`4f72877413d13a67b52b292a8524e2c43a15253c26aaf6b5d0166a65bc615cff`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	1.0.0.0
ProductVersion	1.0.0.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	UNKNOWN
Comments
CompanyName
FileDescription	VBCECompiler
FileVersion (#2)	1.0.0.0
InternalName	VBCECompiler.exe
LegalCopyright	Copyright © 2019
LegalTrademarks
OriginalFilename	VBCECompiler.exe
ProductName	VBCECompiler
ProductVersion (#2)	1.0.0.0
Assembly Version	1.0.0.0

Resource LangID	UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.