5f5b877dfac2a4ec5af890f33d7801c6
This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2021-Feb-02 12:45:32 |
| Debug artifacts |
C:\CHIP\Rel2\dmr\DMR\obj\Debug\DMR.pdb
|
| Comments | Presetup for Content Online |
| CompanyName | Chip Digital GmbH |
| FileDescription | CHIP Secured Installer |
| FileVersion | 3.0.0.7 |
| InternalName | DMR.exe |
| LegalCopyright | Copyright © 2020 Chip Digital GmbH |
| LegalTrademarks | CHIP Secured Installer |
| OriginalFilename | DMR.exe |
| ProductName | CHIP Secured Installer |
| ProductVersion | 3.0.0.7 |
| Assembly Version | 3.0.0.7 |
Plugin Output
| Info | Matching compiler(s): |
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual C++ 8.0 .NET executable -> Microsoft |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Contains references to system / monitoring tools:
|
| Suspicious | Unusual section name found: .sdata | |
| Info | The PE is digitally signed. |
Signer: CHIP Digital GmbH
Issuer: Symantec Class 3 Extended Validation Code Signing CA - G2 |
| Malicious | VirusTotal score: 36/68 (Scanned on 2021-08-18 13:19:07) |
McAfee:
Artemis!5F5B877DFAC2
Cylance: Unsafe K7AntiVirus: Adware ( 004b8e971 ) K7GW: Adware ( 004b8e971 ) Cyren: W32/Application.TEOW-2838 Symantec: PUA.DownloadSponsor ESET-NOD32: a variant of Win32/DownloadSponsor.C potentially unwanted ClamAV: Win.Dropper.Miner-7086571-0 Kaspersky: not-a-virus:HEUR:Downloader.MSIL.DownloadSponsor.gen Alibaba: Downloader:MSIL/Generic.aa3b6f63 NANO-Antivirus: Riskware.Win32.DownloadSponsor.iiybgh ViRobot: Adware.Downloadsponsor.482040 Rising: PUF.DownloadSponsor!1.BE33 (CLASSIC) Emsisoft: Application.AdLoad (A) Comodo: ApplicUnwnt@#3mfep1rhn46ci DrWeb: Adware.Covus.101 TrendMicro: PUA.MSIL.DownloadSponsor.SMDR McAfee-GW-Edition: BehavesLike.Win32.Generic.gh Sophos: Generic ML PUA (PUA) SentinelOne: Static AI - Suspicious PE Jiangmin: Downloader.MSIL.qbu Webroot: W32.Adware.Gen eGambit: Unsafe.AI_Score_99% Antiy-AVL: Trojan/Generic.ASCommon.ED Gridinsoft: PUP.Downloader.dd!c Microsoft: PUA:Win32/DownloadSponsor SUPERAntiSpyware: PUP.Downloader/Variant GData: MSIL.Application.DownloadSponsor.U AhnLab-V3: Malware/Gen.RL_Reputation.C4316742 VBA32: TScope.Trojan.MSIL MAX: malware (ai score=99) Malwarebytes: PUP.Optional.ChipDe Panda: PUP/DownloadAssistant TrendMicro-HouseCall: PUA.MSIL.DownloadSponsor.SMDR MaxSecure: Downloader.MSIL.DownloadSponsor.gen Fortinet: Riskware/DownloadSponsor |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 4 |
| TimeDateStamp | 2021-Feb-02 12:45:32 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 11.0 |
| SizeOfCode | 0x71e00 |
| SizeOfInitializedData | 0x1e00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00073D1E (Section: .text) |
| BaseOfCode | 0x2000 |
| BaseOfData | 0x74000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x7a000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x7fa97 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.sdata
.rsrc
.reloc
Imports
| mscoree.dll |
_CorExeMain
|
|---|
Delayed Imports
2
32512
1
1 (#2)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 3.0.0.7 |
| ProductVersion | 3.0.0.7 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| Comments | Presetup for Content Online |
| CompanyName | Chip Digital GmbH |
| FileDescription | CHIP Secured Installer |
| FileVersion (#2) | 3.0.0.7 |
| InternalName | DMR.exe |
| LegalCopyright | Copyright © 2020 Chip Digital GmbH |
| LegalTrademarks | CHIP Secured Installer |
| OriginalFilename | DMR.exe |
| ProductName | CHIP Secured Installer |
| ProductVersion (#2) | 3.0.0.7 |
| Assembly Version | 3.0.0.7 |
| Resource LangID | UNKNOWN |
|---|
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2021-Feb-02 12:45:32 |
| Version | 0.0 |
| SizeofData | 284 |
| AddressOfRawData | 0x7401c |
| PointerToRawData | 0x7221c |
| Referenced File | C:\CHIP\Rel2\dmr\DMR\obj\Debug\DMR.pdb |