4910f453eeb6fda057d664ed538d2abd
This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2024-Sep-13 11:07:44 |
| CompanyName | Discord Inc. |
| FileDescription | Discord - https://discord.com/ |
| FileVersion | 1.0.9161.0 |
| InternalName | XClient.exe |
| LegalCopyright | Copyright (c) 2024 Discord Inc. All rights reserved. |
| OriginalFilename | XClient.exe |
| ProductName | Discord - https://discord.com/ |
| ProductVersion | 1.0.9161.0 |
| Assembly Version | 1.0.9161.0 |
Plugin Output
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Suspicious |
Unusual section name found: \x1fl//gl\x16o
Section \x1fl//gl\x16o is both writable and executable. Unusual section name found: |
|
| Malicious | VirusTotal score: 40/73 (Scanned on 2024-09-13 11:16:57) |
APEX:
Malicious
AVG: Win32:RATX-gen [Trj] AhnLab-V3: Trojan/Win.Generic.C5444042 Arcabit: Trojan.Lazy.D917D7 Avast: Win32:RATX-gen [Trj] Avira: TR/Spy.Gen BitDefender: Gen:Variant.Lazy.595927 Bkav: W32.AIDetectMalware.CS CTX: exe.unknown.lazy CrowdStrike: win/malicious_confidence_100% (D) Cybereason: malicious.3eeb6f Cylance: Unsafe DeepInstinct: MALICIOUS ESET-NOD32: a variant of MSIL/Bladabindi.NY Elastic: malicious (high confidence) Emsisoft: Gen:Variant.Lazy.595927 (B) F-Secure: Trojan.TR/Spy.Gen FireEye: Generic.mg.4910f453eeb6fda0 GData: Gen:Variant.Lazy.595927 Google: Detected Gridinsoft: Trojan.Heur!.03013281 Ikarus: Trojan-Dropper.MSIL.Agent Kaspersky: HEUR:Trojan.MSIL.Vimditator.gen Kingsoft: malware.kb.c.1000 Malwarebytes: Backdoor.XWorm.Generic MaxSecure: Trojan.Malware.300983.susgen McAfeeD: ti!9F67D70FBA6A MicroWorld-eScan: Gen:Variant.Lazy.595927 Microsoft: Trojan:Win32/Wacatac.B!ml Rising: Trojan.Bladabindi!8.C7 (TFE:dGZlOg0fg4EJtg+YWw) Sangfor: Trojan.Win32.Save.a SentinelOne: Static AI - Malicious PE Skyhigh: BehavesLike.Win32.Generic.gm Sophos: Generic ML PUA (PUA) Symantec: ML.Attribute.HighConfidence Trapmine: malicious.high.ml.score VIPRE: Gen:Variant.Lazy.595927 VirIT: Trojan.Win32.MSIL_Heur.B ZoneAlarm: HEUR:Trojan.MSIL.Vimditator.gen alibabacloud: Trojan:MSIL/Kryptik.ACJQ |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 5 |
| TimeDateStamp | 2024-Sep-13 11:07:44 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 11.0 |
| SizeOfCode | 0x26400 |
| SizeOfInitializedData | 0x44600 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0007000A (Section: ) |
| BaseOfCode | 0x14000 |
| BaseOfData | 0x2000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x74000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
\x1fl//gl\x16o
.text
.rsrc
Section_4
.reloc
Imports
| mscoree.dll |
_CorExeMain
|
|---|
Delayed Imports
1
1 (#2)
1 (#3)
1 (#4)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.0.9161.0 |
| ProductVersion | 1.0.9161.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| CompanyName | Discord Inc. |
| FileDescription | Discord - https://discord.com/ |
| FileVersion (#2) | 1.0.9161.0 |
| InternalName | XClient.exe |
| LegalCopyright | Copyright (c) 2024 Discord Inc. All rights reserved. |
| OriginalFilename | XClient.exe |
| ProductName | Discord - https://discord.com/ |
| ProductVersion (#2) | 1.0.9161.0 |
| Assembly Version | 1.0.9161.0 |
| Resource LangID | UNKNOWN |
|---|