Manalyze report for 613dc150c8d472d2d3ff5e27b5e506da54dfe9bd070cd8f73160c274adb2217b

This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2082-Feb-08 07:24:55
Comments
CompanyName
FileDescription
FileVersion	`1.0.0.0`
InternalName	Bqkmpq.exe
LegalCopyright
LegalTrademarks
OriginalFilename	Bqkmpq.exe
ProductName
ProductVersion	`1.0.0.0`
Assembly Version	1.0.0.0

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C# v7.0 / Basic .NET`
Suspicious	PEiD Signature:	`HQR data file`
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to MD5`
Malicious	VirusTotal score: 53/69 (Scanned on 2026-05-03 20:24:21)	`APEX: Malicious` `AVG: Win32:MalwareX-gen [Pws]` `Alibaba: TrojanPSW:MSIL/PureLogs.ef9174d2` `Antiy-AVL: Trojan[PSW]/MSIL.PureLogs` `Arcabit: Trojan.MSIL.Benin.5` `Avast: Win32:MalwareX-gen [Pws]` `Avira: TR/Crypt.XPACK.Gen8` `BitDefender: Gen:Heur.MSIL.Benin.5` `Bkav: W32.AIDetectMalware.CS` `CTX: exe.trojan.msil` `CrowdStrike: win/malicious_confidence_100% (W)` `Cylance: Unsafe` `DeepInstinct: MALICIOUS` `DrWeb: Trojan.PWS.Stealer.45216` `ESET-NOD32: MSIL/Kryptik.APNJ trojan` `Elastic: malicious (high confidence)` `Emsisoft: Gen:Heur.MSIL.Benin.5 (B)` `F-Secure: Trojan.TR/Crypt.XPACK.Gen8` `Fortinet: MSIL/Kryptik.APOH!tr` `GData: Gen:Heur.MSIL.Benin.5` `Google: Detected` `Gridinsoft: Trojan.Win32.Kryptik.sa` `Ikarus: Trojan.SuspectCRC` `K7AntiVirus: Trojan ( 700000201 )` `K7GW: Trojan ( 700000201 )` `Kaspersky: HEUR:Trojan-PSW.MSIL.PureLogs.gen` `Kingsoft: MSIL.Trojan-PSW.PureLogs.gen` `Lionic: Trojan.Win32.PureLogs.i!c` `Malwarebytes: Trojan.Crypt` `MaxSecure: Trojan.Malware.345032243.susgen` `McAfeeD: Real Protect-LS!9AFFDD7C9E33` `MicroWorld-eScan: Gen:Heur.MSIL.Benin.5` `Microsoft: Trojan:Win32/Kepavll!rfn` `Paloalto: generic.ml` `Panda: Trj/Agent.AY` `Rising: Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:A8e3x0WuE09M+YYROno4wA)` `Sangfor: Suspicious.Win32.Save.a` `SentinelOne: Static AI - Malicious PE` `Skyhigh: Artemis!Trojan` `Sophos: Mal/Generic-S` `Trapmine: malicious.moderate.ml.score` `TrellixENS: Artemis!9AFFDD7C9E33` `TrendMicro-HouseCall: Trojan.Win32.VSX.PE04C9z` `VBA32: TrojanPSW.MSIL.PureLogs` `VIPRE: Gen:Heur.MSIL.Benin.5` `Varist: W32/MSIL_Kryptik.MYG.gen!Eldorado` `ViRobot: Trojan.Win.Z.Kryptik.978432` `VirIT: Trojan.Win32.GenusT.FNOA` `Webroot: W32.Trojan.Gen` `Yandex: Trojan.Kryptik!PPE9SAX/0rk` `Zillya: Trojan.Kryptik.Win32.5819606` `alibabacloud: Trojan[stealer]:MSIL/PureLogs.gyf` `tehtris: Generic.Malware`

Hashes

MD5	`9affdd7c9e339bcc31ec01138ab9a665`
SHA1	`fe15f824f986094f97ade3baf2083a1474e8ee23`
SHA256	`613dc150c8d472d2d3ff5e27b5e506da54dfe9bd070cd8f73160c274adb2217b`
SHA3	`23936fdf27af7f193d2dd18238daf797ae44ebfd68b5eac01033893052af191e`
SSDeep	`12288:/wCzx0NqCwvkDwjtUwyYJ8KgMqxVu3d6YGGhBoOIURJIUqy1jAZlk5W9Zx/fNc+:/zwqMDw6wyYJ8vI3GGzeQJIUjM00fL`
Imports Hash	`f34d5f2d4577ed6d9ceec516c1f5a744`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`3`
TimeDateStamp	2082-Feb-08 07:24:55
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_LOCAL_SYMS_STRIPPED`

Image Optional Header

Magic	`PE32`
LinkerVersion	`48.0`
SizeOfCode	`0xee400`
SizeOfInitializedData	`0x800`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x000F034E (Section: .text)`
BaseOfCode	`0x2000`
BaseOfData	`0xf2000`
ImageBase	`0x400000`
SectionAlignment	`0x2000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`4.0`
Win32VersionValue	`0`
SizeOfImage	`0xf6000`
SizeOfHeaders	`0x200`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_NO_SEH` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`fd8de355f1b53aa44ccea7a1aa61cbd4`
SHA1	`e67359261d14e8d8afaa25d795d8e3a63fe2627d`
SHA256	`49d5fbc93a6f3de0802a6800e697481b309a5fc8a52f13c66d563b633bf83287`
SHA3	`dc22f7bedac7c20874aa65c4784112c048a211c142f80fdcc742bc946a2fb915`
VirtualSize	`0xee354`
VirtualAddress	`0x2000`
SizeOfRawData	`0xee400`
PointerToRawData	`0x200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`7.60916`

.rsrc

MD5	`016d9b606b1802041fc6ef1607c1ff82`
SHA1	`8922794453c0171e399febcbc96840b61cc71fda`
SHA256	`c2cafe4189202bab5b300fe5936e252c5e7e694d6eb0fc98a3f8b4e545762d8f`
SHA3	`27f0e97eb134e312024855651398f2405f0a008ae88412d00c77f9e8e95f3a07`
VirtualSize	`0x560`
VirtualAddress	`0xf2000`
SizeOfRawData	`0x600`
PointerToRawData	`0xee600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`3.92805`

.reloc

MD5	`483efd24b3110dab18349e2d38301a2d`
SHA1	`866b8fdcd6b2a7187e2ac08c53eadc3f5098afbe`
SHA256	`4d83e7488fdea4111731bff7a81d9709b6d400597439e122602c7715d1171df7`
SHA3	`ca2161aaad5a25dbc68c8eb071b4a2875fadff35768eb3f037997230a77a5c45`
VirtualSize	`0xc`
VirtualAddress	`0xf4000`
SizeOfRawData	`0x200`
PointerToRawData	`0xeec00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.0815394`

Imports

mscoree.dll	`_CorExeMain`

Delayed Imports

1

Type	`RT_VERSION`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x2d4`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.17791`
MD5	`ee8926ede9f5889a46ffc0d9d7b3b214`
SHA1	`44396e5467ccdf7df8ccc49232d3d8714a5c901d`
SHA256	`df594580d637cc42abb8f295cc5c4db36e8f8a0377955733b773c439d5c67555`
SHA3	`5d882294f0cf633d2dc00ce256065d60f3b67645f2f100c656ff89c4198b1301`

1 (#2)

Type	`RT_MANIFEST`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x1ea`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.00112`
MD5	`b7db84991f23a680df8e95af8946f9c9`
SHA1	`cac699787884fb993ced8d7dc47b7c522c7bc734`
SHA256	`539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a`
SHA3	`4f72877413d13a67b52b292a8524e2c43a15253c26aaf6b5d0166a65bc615cff`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	1.0.0.0
ProductVersion	1.0.0.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	UNKNOWN
Comments
CompanyName
FileDescription
FileVersion (#2)	1.0.0.0
InternalName	Bqkmpq.exe
LegalCopyright
LegalTrademarks
OriginalFilename	Bqkmpq.exe
ProductName
ProductVersion (#2)	1.0.0.0
Assembly Version	1.0.0.0

Resource LangID	UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.