Manalyze report for 55284bc18ecd9b91afe707d03e74e6f3

This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2024-Nov-13 03:08:27
FileDescription
FileVersion	`0.0.0.0`
InternalName	nonoo.exe
LegalCopyright
OriginalFilename	nonoo.exe
ProductVersion	`0.0.0.0`
Assembly Version	0.0.0.0

Plugin Output

Info	Matching compiler(s):	`.NET executable -> Microsoft`
Suspicious	Strings found in the binary may indicate undesirable behavior:	`Contains references to security software: rshell.exe`
Malicious	VirusTotal score: 48/72 (Scanned on 2024-11-28 04:30:44)	`ALYac: Trojan.GenericKD.74788822` `APEX: Malicious` `AVG: Win32:Malware-gen` `AhnLab-V3: Trojan/Win.Generic.C4386925` `Alibaba: Trojan:Win32/Kryptik.3141c660` `Antiy-AVL: Trojan/Win32.Convagent` `Arcabit: Trojan.Generic.D4752FD6` `Avast: Win32:Malware-gen` `Avira: TR/AVI.Agent.pvpwx` `BitDefender: Trojan.GenericKD.74788822` `Bkav: W32.AIDetectMalware.CS` `CAT-QuickHeal: Trojan.Generic.TRFH1162` `CTX: exe.trojan.generic` `CrowdStrike: win/malicious_confidence_100% (W)` `Cylance: Unsafe` `DeepInstinct: MALICIOUS` `ESET-NOD32: PowerShell/Kryptik.IY` `Elastic: malicious (high confidence)` `Emsisoft: Trojan.GenericKD.74788822 (B)` `F-Secure: Trojan.TR/AVI.Agent.pvpwx` `FireEye: Generic.mg.55284bc18ecd9b91` `Fortinet: PowerShell/Kryptik.IY!tr` `GData: MSIL.Trojan.PSE.BIBTMC` `Google: Detected` `Gridinsoft: Ransom.Win32.Wacatac.sa` `Ikarus: HackTool.Win32.Malagent` `K7AntiVirus: Trojan ( 005bc93a1 )` `K7GW: Trojan ( 005bc93a1 )` `Kaspersky: VHO:Trojan.Win32.Convagent.gen` `Kingsoft: malware.kb.c.747` `Lionic: Trojan.Win32.Convagent.4!c` `Malwarebytes: Malware.AI.1215894569` `MaxSecure: Trojan.Malware.109653022.susgen` `McAfee: GenericRXWO-FX!55284BC18ECD` `McAfeeD: ti!56C7F36C1FA8` `MicroWorld-eScan: Trojan.GenericKD.74788822` `Microsoft: Program:Win32/Wacapew.C!ml` `Sangfor: Trojan.Win32.Agent.Vfti` `SentinelOne: Static AI - Malicious PE` `Skyhigh: BehavesLike.Win32.Trojan.pm` `Sophos: Mal/Generic-S` `Symantec: ML.Attribute.HighConfidence` `Tencent: Malware.Win32.Gencirc.1421b75f` `Trapmine: malicious.high.ml.score` `TrendMicro-HouseCall: TROJ_GEN.R06CH09KK24` `VIPRE: Trojan.GenericKD.74788822` `Varist: W32/MSIL_Agent.HYO.gen!Eldorado` `alibabacloud: Trojan:Win/Wacatac.B9nj`

Hashes

MD5	`55284bc18ecd9b91afe707d03e74e6f3`
SHA1	`1744939aeebe519179446ad0026f0774b7cf8b00`
SHA256	`56c7f36c1fa80afe94162a66925d119a8537f5ec045ac43be92d8c48ef2b81da`
SHA3	`4ead27a6fa0e3daa15717306c6785cb9f900d0c64b040b7c136353d8ae969bd2`
SSDeep	`384:XxiHABz9q3FxmHu+JjOdumearwrhQgX2vx51h8wgZKe5AQMrllIQQ9aNcpMQiW4:XCIFqearwregZKeSd1XbOfq1tkapj`
Imports Hash	`f34d5f2d4577ed6d9ceec516c1f5a744`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`3`
TimeDateStamp	2024-Nov-13 03:08:27
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`11.0`
SizeOfCode	`0x9e00`
SizeOfInitializedData	`0x800`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0000BDEE (Section: .text)`
BaseOfCode	`0x2000`
BaseOfData	`0xc000`
ImageBase	`0x400000`
SectionAlignment	`0x2000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`4.0`
Win32VersionValue	`0`
SizeOfImage	`0x10000`
SizeOfHeaders	`0x200`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_NO_SEH` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`284ae68fd2a5c22bc0e36c0f095a1cf3`
SHA1	`619ca53448d2b203a9323b0882fd8eeddd942002`
SHA256	`1a982b4841d5e2dcae600fd7fdbc4be6dec805c3c8c8b51d2151991e6b0ced23`
SHA3	`33e111289b5cb9db5b82997a6ade714b87fcfa62b6ff8c250679f599444de614`
VirtualSize	`0x9df4`
VirtualAddress	`0x2000`
SizeOfRawData	`0x9e00`
PointerToRawData	`0x200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`5.9239`

.rsrc

MD5	`8311516eafddf6285e58f7225d391a9c`
SHA1	`4338a5cf5eb601cbe583acaed7f1034185e7d92a`
SHA256	`b8dc5b42f2e7ce700a8a5ee9b48c40f876416bc83552e36c24dde015821a06d8`
SHA3	`679fab72e213aed56a1463c818c42e82e1fb5c3228e49b82fe0686f7a5e17ed0`
VirtualSize	`0x4d0`
VirtualAddress	`0xc000`
SizeOfRawData	`0x600`
PointerToRawData	`0xa000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`3.67537`

.reloc

MD5	`d3d0feaa1d7c6dff13f107240b4893bc`
SHA1	`16afdc4468263f6c9707947386d539fb9a399854`
SHA256	`00a4727cf593ef0ea96fd57bd9d855a31f58187a1e81867842058448da25f35b`
SHA3	`2371226248a2a385b9d7b05b60ab9aec7f489c91ce973a6c6031d33bdddaeac9`
VirtualSize	`0xc`
VirtualAddress	`0xe000`
SizeOfRawData	`0x200`
PointerToRawData	`0xa600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.0815394`

Imports

mscoree.dll	`_CorExeMain`

Delayed Imports

1

Type	`RT_VERSION`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x23c`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.13223`
MD5	`a7b37d17bb39f9fb4830c429cd182572`
SHA1	`2c71c073e59382c677d8a868637de45dd4d0f616`
SHA256	`65c204bc2c60fd48f157c16d37961d5c3b6e1c4d876bebcd288696b2ceffeb44`
SHA3	`143cf6c9521d634689354be4f097f360f4cd0820dd8eb60575d037ac7571ee70`

1 (#2)

Type	`RT_MANIFEST`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x1ea`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.00112`
MD5	`a19a2658ba69030c6ac9d11fd7d7e3c1`
SHA1	`879dcf690e5bf1941b27cf13c8bcf72f8356c650`
SHA256	`c0085eb467d2fc9c9f395047e057183b3cd1503a4087d0db565161c13527a76f`
SHA3	`93cbaf236d2d3870c1052716416ddf1c34f21532e56dd70144e9a01efcd0ce34`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	0.0.0.0
ProductVersion	0.0.0.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	UNKNOWN
FileDescription
FileVersion (#2)	0.0.0.0
InternalName	nonoo.exe
LegalCopyright
OriginalFilename	nonoo.exe
ProductVersion (#2)	0.0.0.0
Assembly Version	0.0.0.0

Resource LangID	UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

55284bc18ecd9b91afe707d03e74e6f3

Summary

Plugin Output

Hashes

DOS Header

PE Header

Image Optional Header

.text

.rsrc

.reloc

Imports

Delayed Imports

1

1 (#2)

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors