Manalyze report for 5dd7015fc70b9e59f4cce97c67a200f912fb59112b5f13a45535ede6dca73a72

This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2026-Sep-24 09:04:38
FileDescription
FileVersion	`0.0.0.0`
InternalName	Program.exe
LegalCopyright
OriginalFilename	Program.exe
ProductVersion	`0.0.0.0`
Assembly Version	0.0.0.0

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C# v7.0 / Basic .NET` `.NET executable -> Microsoft`
Malicious	VirusTotal score: 4/71 (Scanned on 2026-09-25 18:41:56)	`APEX: Malicious` `McAfeeD: Real Protect-LS!165887014E16` `Microsoft: Trojan:Win32/Wacatac.B!ml` `Trapmine: malicious.moderate.ml.score`

Hashes

MD5	`165887014e16d09285e1e25580c810b9` 🔍
SHA1	`aa235a6c0a9ac912a524c0ea709cdecf8f1a9026` 🔍
SHA256	`5dd7015fc70b9e59f4cce97c67a200f912fb59112b5f13a45535ede6dca73a72` 🔍
SHA3	`27353bde9d475248aae21f275131b842693681810177611d9975fb5be25a66eb` 🔍
SSDeep	`96:iAvLJ7xnUMceZlmpcbMiMipL+XMyPpwByQVxEzNt:L3FlZwpcuhxcu` 🔍
Imports Hash	`f34d5f2d4577ed6d9ceec516c1f5a744` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`3`
TimeDateStamp	2026-Sep-24 09:04:38
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`11.0`
SizeOfCode	`0xe00`
SizeOfInitializedData	`0x800`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x00002D4E (Section: .text)`
BaseOfCode	`0x2000`
BaseOfData	`0x4000`
ImageBase	`0x400000`
SectionAlignment	`0x2000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`4.0`
Win32VersionValue	`0`
SizeOfImage	`0x8000`
SizeOfHeaders	`0x200`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_NO_SEH` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`2806a24306eb7dda3b95033ece7fe193 🔍`
SHA1	`00106d2f78ba673a35a544c926c2462a8c625517 🔍`
SHA256	`fa72e1c295f0bef11ee57a3edd6f7d6a7589830f206495ae64c9496f3f795dbf 🔍`
SHA3	`dec8525e2ff18126187d980c39c47f327cd376c298e9966b7f9d567eac2f35be 🔍`
VirtualSize	`0xd54`
VirtualAddress	`0x2000`
SizeOfRawData	`0xe00`
PointerToRawData	`0x200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`4.55449`

.rsrc

MD5	`c98bd4ec607f39c619c675cdf2990a6b 🔍`
SHA1	`853253c01a56e750db9f518ecf6314f53d3df1c2 🔍`
SHA256	`524d1f66f94a29a01808743fc52298109aacbd2feeabf4c6099b5a712254978a 🔍`
SHA3	`1781ae9f1b79913ca4d44a45c731ec2ee7ec5def7e9002251c8a9068584a10e3 🔍`
VirtualSize	`0x4d8`
VirtualAddress	`0x4000`
SizeOfRawData	`0x600`
PointerToRawData	`0x1000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`3.705`

.reloc

MD5	`924baa91927078100f7d805d89e40f45 🔍`
SHA1	`a70f1e691ebf16815368a6d3027533accbeb0ea1 🔍`
SHA256	`3878532de5d4480c2e1228dec027c60ea5a822ca137158a90678a095397877bf 🔍`
SHA3	`19db211566a7b73fb68eb4bb670ec9b31e42d52b600a9d58fa271aa0e0927a92 🔍`
VirtualSize	`0xc`
VirtualAddress	`0x6000`
SizeOfRawData	`0x200`
PointerToRawData	`0x1600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.0815394`

Imports

mscoree.dll	`_CorExeMain`

Delayed Imports

1

Type	`RT_VERSION`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x244`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.1613`
MD5	`f27663b3fd8adaeacff3d358125d73e1 🔍`
SHA1	`edf24ea92d0a27358bba71445fd28b2ec2c44921 🔍`
SHA256	`1f1150127267cdc37c8c1b008b5312ea3d6d8396f9741042cb9f874d80b295ce 🔍`
SHA3	`aca4f2906ef3f1ad70a6ccff0d0c3beb0860ed3275dacb47e5e7d52bc87c26a6 🔍`

1 (#2)

Type	`RT_MANIFEST`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x1ea`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.00112`
MD5	`a19a2658ba69030c6ac9d11fd7d7e3c1 🔍`
SHA1	`879dcf690e5bf1941b27cf13c8bcf72f8356c650 🔍`
SHA256	`c0085eb467d2fc9c9f395047e057183b3cd1503a4087d0db565161c13527a76f 🔍`
SHA3	`93cbaf236d2d3870c1052716416ddf1c34f21532e56dd70144e9a01efcd0ce34 🔍`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	0.0.0.0
ProductVersion	0.0.0.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	UNKNOWN
FileDescription
FileVersion (#2)	0.0.0.0
InternalName	Program.exe
LegalCopyright
OriginalFilename	Program.exe
ProductVersion (#2)	0.0.0.0
Assembly Version	0.0.0.0

Resource LangID	UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.