×
This file seems to be a .NET executable .
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Architecture
IMAGE_FILE_MACHINE_I386
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date
2024-Jan-22 09:11:00
FileDescription
FileVersion
1.0.0.0
InternalName
24eacbb4-825a-4768-ad59-21c6c6ffb60d.exe
LegalCopyright
OriginalFilename
24eacbb4-825a-4768-ad59-21c6c6ffb60d.exe
ProductVersion
1.0.0.0
Assembly Version
1.0.0.0
Info
Matching compiler(s):
Microsoft Visual C# v7.0 / Basic .NET
.NET executable -> Microsoft
Suspicious
Strings found in the binary may indicate undesirable behavior:
May have dropper capabilities:
Contains domain names:
account.dyn.com
discord.com
gmail.com
https://account.dyn.com
https://account.dyn.com/
mail.musabody.com
musabody.com
paltalk.com
privateinternetaccess.com
Suspicious
No VirusTotal score.
This file has never been scanned on VirusTotal.
MD5
478e54ca81a01c6d79fa4adc9b6cc984
SHA1
ba42b119eea964ef0a8368d6750ebbcee17b62cf
SHA256
329fc3ab0b9cf28cf3124788bd07d8e5aa1349d16d9eaeee03cbe2eeb244a8c2
SHA3
776a48a81e7da700323de8cf26db19a868326cbf1a161f022e12f64e72281134
SSDeep
3072:eRMYE48bwYaBj5jNcosLx4EyJdOo/tQGe5NH39260:eRMYE48bwYaBjhKN14rdNBuX9X
Imports Hash
f34d5f2d4577ed6d9ceec516c1f5a744
e_magic
MZ
e_cblp
0x90
e_cp
0x3
e_crlc
0
e_cparhdr
0x4
e_minalloc
0
e_maxalloc
0xffff
e_ss
0
e_sp
0xb8
e_csum
0
e_ip
0
e_cs
0
e_ovno
0
e_oemid
0
e_oeminfo
0
e_lfanew
0x80
Signature
PE
Machine
IMAGE_FILE_MACHINE_I386
NumberofSections
3
TimeDateStamp
2024-Jan-22 09:11:00
PointerToSymbolTable
0
NumberOfSymbols
0
SizeOfOptionalHeader
0xe0
Characteristics
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
Magic
PE32
LinkerVersion
11.0
SizeOfCode
0x3a200
SizeOfInitializedData
0x800
SizeOfUninitializedData
0
AddressOfEntryPoint
0x0003C14E (Section: .text)
BaseOfCode
0x2000
BaseOfData
0x3e000
ImageBase
0x400000
SectionAlignment
0x2000
FileAlignment
0x200
OperatingSystemVersion
4.0
ImageVersion
0.0
SubsystemVersion
4.0
Win32VersionValue
0
SizeOfImage
0x42000
SizeOfHeaders
0x200
Checksum
0
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve
0x100000
SizeofStackCommit
0x1000
SizeofHeapReserve
0x100000
SizeofHeapCommit
0x1000
LoaderFlags
0
NumberOfRvaAndSizes
16
MD5
76a9ea25131586207faafbeca936d1d0
SHA1
64d96ebf26bf2439a7a74aea12e2fd7ed3241b19
SHA256
37cc08ab9297e3a31a7ff3a5a1b9cbd74623bd9ff013e663d1dd58fa9930f567
SHA3
3b95f75d2562282b2b7ceb5c5d5a7aa117798ff6d0953fb63325b86466d9b9f5
VirtualSize
0x3a154
VirtualAddress
0x2000
SizeOfRawData
0x3a200
PointerToRawData
0x200
PointerToRelocations
0
PointerToLineNumbers
0
NumberOfLineNumbers
0
NumberOfRelocations
0
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy
5.0166
MD5
24168f9e2e1cf2e77222276133c60b17
SHA1
007c6c13f26f2b61e3e24283dfc8e5c8ae39f66f
SHA256
9a8d8b1711f10b6f06faeefefb64a090c5a874739d4c0bb62b6229cd371023bf
SHA3
1bdbcd1ad12cb60a984bb322b0fb5d9bb986d0b9a96e22ba05bcbfa55cad438c
VirtualSize
0x546
VirtualAddress
0x3e000
SizeOfRawData
0x600
PointerToRawData
0x3a400
PointerToRelocations
0
PointerToLineNumbers
0
NumberOfLineNumbers
0
NumberOfRelocations
0
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy
4.00181
MD5
588a386272f9d224ed2d5caed0cbeaad
SHA1
adea35299b1035c945895e19c7fc4efea884a5a4
SHA256
64ab9e562f6bc37ab47e7e425f0631f65510a895caee6c6e22abef9e41ad4a7e
SHA3
4846ae59448a06e46b57ec07a68f7c38bb2a744b37bbeb5d94ed7b5aad3744db
VirtualSize
0xc
VirtualAddress
0x40000
SizeOfRawData
0x200
PointerToRawData
0x3aa00
PointerToRelocations
0
PointerToLineNumbers
0
NumberOfLineNumbers
0
NumberOfRelocations
0
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy
0.10191
Type
RT_VERSION
Language
UNKNOWN
Codepage
UNKNOWN
Size
0x2bc
TimeDateStamp
1980-Jan-01 00:00:00
Entropy
3.35993
MD5
0ca9a550cb9b70884ebb50466cc78605
SHA1
7d49871330e4e3d7866f016b19d30876fc558842
SHA256
b343ddad825e2caf651f9a06c5e8888984a1e589ba90a248e13b98f019163c17
SHA3
6d1f5dec0bea7731b7b30cf2ea6f7a0bcf4baffbfa95e684021d9c1f4f87ed84
Type
RT_MANIFEST
Language
UNKNOWN
Codepage
UNKNOWN
Size
0x1ea
TimeDateStamp
1980-Jan-01 00:00:00
Entropy
5.00112
MD5
a19a2658ba69030c6ac9d11fd7d7e3c1
SHA1
879dcf690e5bf1941b27cf13c8bcf72f8356c650
SHA256
c0085eb467d2fc9c9f395047e057183b3cd1503a4087d0db565161c13527a76f
SHA3
93cbaf236d2d3870c1052716416ddf1c34f21532e56dd70144e9a01efcd0ce34
Signature
0xfeef04bd
StructVersion
0x10000
FileVersion
1.0.0.0
ProductVersion
1.0.0.0
FileFlags
(EMPTY)
FileOs
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType
VFT_APP
Language
UNKNOWN
FileDescription
FileVersion (#2)
1.0.0.0
InternalName
24eacbb4-825a-4768-ad59-21c6c6ffb60d.exe
LegalCopyright
OriginalFilename
24eacbb4-825a-4768-ad59-21c6c6ffb60d.exe
ProductVersion (#2)
1.0.0.0
Assembly Version
1.0.0.0