46d1995f95bb1dbc0cf3de793387c01c
This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2089-Jun-02 08:48:53 |
| Debug artifacts |
gfhhdrty.pdb
|
| Comments | fghbgnhh dyyyte yj |
| CompanyName | samefoob |
| FileDescription | hkjhanscuaua |
| FileVersion | 3.6.4222.18 |
| InternalName | gfhhdrty.exe |
| LegalCopyright | 2022 |
| LegalTrademarks | gfhthh454ty |
| OriginalFilename | gfhhdrty.exe |
| ProductName | |
| ProductVersion | 3.6.4222.18 |
| Assembly Version | 3.6.4222.18 |
Plugin Output
| Info | Matching compiler(s): | Microsoft Visual C# v7.0 / Basic .NET |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Miscellaneous malware strings:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to MD5
Uses constants related to SHA1 Uses constants related to SHA256 Uses constants related to SHA512 Uses constants related to AES Uses constants related to Blowfish Uses constants related to RC5 or RC6 Uses constants related to Twofish Uses constants related to TEA |
| Suspicious | Unusual section name found: .sdata | |
| Malicious | VirusTotal score: 38/69 (Scanned on 2024-01-12 17:48:17) |
APEX:
Malicious
AVG: Win32:DropperX-gen [Drp] AhnLab-V3: Trojan/Win.MSILZilla.C5565811 Antiy-AVL: Trojan[PSW]/MSIL.Stealer Avast: Win32:DropperX-gen [Drp] Avira: HEUR/AGEN.1353914 BitDefenderTheta: Gen:NN.ZemsilF.36680.@t0@aai3q0l Bkav: W32.AIDetectMalware.CS CrowdStrike: win/malicious_confidence_70% (D) Cylance: unsafe Cynet: Malicious (score: 99) DeepInstinct: MALICIOUS Elastic: malicious (high confidence) F-Secure: Heuristic.HEUR/AGEN.1353914 Fortinet: PossibleThreat GData: Win32.Trojan.Agent.UCP3N3 Google: Detected Gridinsoft: Trojan.Win32.Agent.sa Kaspersky: HEUR:Trojan-PSW.MSIL.Stealer.gen Kingsoft: MSIL.Trojan-PSW.Stealer.gen Lionic: Trojan.Win32.Stealer.12!c Malwarebytes: Generic.Malware/Suspicious MaxSecure: Trojan.Malware.74396735.susgen McAfee: Artemis!46D1995F95BB Microsoft: Program:Win32/Wacapew.C!ml Panda: Trj/Chgt.AD Rising: Stealer.Agent!8.C2 (CLOUD) Sangfor: Infostealer.Win32.Agent.Vy97 SentinelOne: Static AI - Suspicious PE Skyhigh: Artemis!Trojan Sophos: Generic Reputation PUA (PUA) Symantec: ML.Attribute.HighConfidence Tencent: Malware.Win32.Gencirc.13faa394 TrendMicro-HouseCall: TROJ_GEN.R023H0CLQ23 Varist: W32/ABRisk.DNHG-8457 ViRobot: Trojan.Win.Z.Stealer.4336128 Zillya: Trojan.Stealer.Win32.168185 ZoneAlarm: HEUR:Trojan-PSW.MSIL.Stealer.gen |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 4 |
| TimeDateStamp | 2089-Jun-02 08:48:53 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 6.0 |
| SizeOfCode | 0x3d1400 |
| SizeOfInitializedData | 0x51200 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x003D32AE (Section: .text) |
| BaseOfCode | 0x2000 |
| BaseOfData | 0x3d4000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x428000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 15 |
.text
.sdata
.rsrc
.reloc
Imports
| mscoree.dll |
_CorExeMain
|
|---|
Delayed Imports
1
2
3
4
5
6
7
8
9
32512
1 (#2)
1 (#3)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 3.6.4222.18 |
| ProductVersion | 3.6.4222.18 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| Comments | fghbgnhh dyyyte yj |
| CompanyName | samefoob |
| FileDescription | hkjhanscuaua |
| FileVersion (#2) | 3.6.4222.18 |
| InternalName | gfhhdrty.exe |
| LegalCopyright | 2022 |
| LegalTrademarks | gfhthh454ty |
| OriginalFilename | gfhhdrty.exe |
| ProductName | |
| ProductVersion (#2) | 3.6.4222.18 |
| Assembly Version | 3.6.4222.18 |
| Resource LangID | UNKNOWN |
|---|
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| SizeofData | 37 |
| AddressOfRawData | 0x3d3237 |
| PointerToRawData | 0x3d1637 |
| Referenced File | gfhhdrty.pdb |