5a47100424e87547abb95c80227874ad77699f523c87cf3b064c4e135967caa3
This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2091-Jun-12 07:30:58 |
| Comments | |
| CompanyName | |
| FileDescription | Client |
| FileVersion | 1.0.0.0 |
| InternalName | Client.exe |
| LegalCopyright | Copyright © 2026 |
| LegalTrademarks | |
| OriginalFilename | Client.exe |
| ProductName | Client |
| ProductVersion | 1.0.0.0 |
| Assembly Version | 1.0.0.0 |
Plugin Output
| Info | Matching compiler(s): |
Microsoft Visual C# v7.0 / Basic .NET
.NET executable -> Microsoft |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Contains references to system / monitoring tools:
|
| Malicious | VirusTotal score: 39/72 (Scanned on 2026-04-15 16:04:03) |
ALYac:
Gen:Variant.Application.Strictor.240530
APEX: Malicious AVG: MalwareX-gen [Trj] AhnLab-V3: Trojan/Win.Generic.C5864478 Antiy-AVL: Trojan/MSIL.AsyncRAT Arcabit: Trojan.Application.Strictor.D3AB92 Avast: MalwareX-gen [Trj] BitDefender: Gen:Variant.Application.Strictor.240530 CTX: exe.unknown.strictor CrowdStrike: win/malicious_confidence_90% (D) Cylance: Unsafe DeepInstinct: MALICIOUS DrWeb: Trojan.DownLoader49.34723 ESET-NOD32: MSIL/Agent.FQI trojan Elastic: malicious (high confidence) Emsisoft: Gen:Variant.Application.Strictor.240530 (B) Fortinet: MSIL/Agent.FQI!tr GData: Gen:Variant.Application.Strictor.240530 Google: Detected Ikarus: Trojan-Spy.StormKitty K7AntiVirus: Trojan ( 700000201 ) K7GW: Trojan ( 700000201 ) Kaspersky: HEUR:Trojan.MSIL.Agent.gen Malwarebytes: Malware.AI.3906453076 McAfeeD: Real Protect-LS!31F9649A49BE MicroWorld-eScan: Gen:Variant.Application.Strictor.240530 Microsoft: Trojan:MSIL/AsyncRAT!atmn Panda: Trj/GdSda.A Sangfor: Suspicious.Win32.Save.a SentinelOne: Static AI - Malicious PE Sophos: Troj/MSIL-TKP Symantec: ML.Attribute.HighConfidence Tencent: Backdoor.Msil.DcRat.16003533 TrendMicro-HouseCall: Trojan.Win32.VSX.PE04C9z VIPRE: Gen:Variant.Application.Strictor.240530 Varist: W32/MSIL_Agent.KXB.gen!Eldorado VirIT: Trojan.Win32.MSIL_Heur.A ZoneAlarm: Troj/MSIL-TKP huorong: Backdoor/MSIL.DcRat.a |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2091-Jun-12 07:30:58 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 48.0 |
| SizeOfCode | 0x93600 |
| SizeOfInitializedData | 0x29e00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0009556E (Section: .text) |
| BaseOfCode | 0x2000 |
| BaseOfData | 0x96000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xc2000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rsrc
.reloc
Imports
| mscoree.dll |
_CorExeMain
|
|---|
Delayed Imports
1
2
3
4
5
6
1 (#2)
1 (#3)
1 (#4)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.0.0.0 |
| ProductVersion | 1.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| Comments | |
| CompanyName | |
| FileDescription | Client |
| FileVersion (#2) | 1.0.0.0 |
| InternalName | Client.exe |
| LegalCopyright | Copyright © 2026 |
| LegalTrademarks | |
| OriginalFilename | Client.exe |
| ProductName | Client |
| ProductVersion (#2) | 1.0.0.0 |
| Assembly Version | 1.0.0.0 |
| Resource LangID | UNKNOWN |
|---|
TLS Callbacks
Load Configuration
RICH Header
Errors
Leave a comment
No comments yet.