Manalyze report for 633ebe097ad8f14f338bd3ce73938ba3c8a4ecf97fc55625427e83e50d9241ed

This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2023-Oct-16 21:40:53
Comments
CompanyName
FileDescription
FileVersion	`1.0.0.0`
InternalName	Stub.exe
LegalCopyright
LegalTrademarks
OriginalFilename	Stub.exe
ProductName
ProductVersion	`1.0.0.0`
Assembly Version	1.0.0.0

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C# v7.0 / Basic .NET` `.NET executable -> Microsoft`
Suspicious	Strings found in the binary may indicate undesirable behavior:	`Contains references to system / monitoring tools: schtask` `Looks for VMWare presence: vmware` `Looks for Sandboxie presence: SbieDll.dll` `Accesses the WMI: root\Security`
Malicious	VirusTotal score: 56/70 (Scanned on 2026-09-17 00:03:24)	`ALYac: Generic.AsyncRAT.Marte.B.CAADFDDD` `APEX: Malicious` `AVG: MSIL:AsyncRat-E [Pws]` `AhnLab-V3: Malware/Win32.RL_Generic.C3558490` `Antiy-AVL: Trojan[Backdoor]/MSIL.Crysan` `Arcabit: Generic.AsyncRAT.Marte.B.CAADFDDD` `Avast: MSIL:AsyncRat-E [Pws]` `Avira: TR/Dropper.Gen` `BitDefender: Generic.AsyncRAT.Marte.B.CAADFDDD` `Bkav: W32.Malware.590B066E` `CAT-QuickHeal: Trojan.IgenericFC.S14890850` `CTX: exe.trojan.msil` `ClamAV: Win.Packed.Razy-9625918-0` `CrowdStrike: win/malicious_confidence_100% (W)` `Cylance: Unsafe` `DeepInstinct: MALICIOUS` `DrWeb: Trojan.Siggen9.56514` `ESET-NOD32: MSIL/AsyncRAT.A trojan` `Elastic: Windows.Generic.Threat` `Emsisoft: Generic.AsyncRAT.Marte.B.CAADFDDD (B)` `F-Secure: Trojan.TR/Dropper.Gen` `Fortinet: MSIL/AsyncRAT.A!tr` `GData: MSIL.Backdoor.DCRat.D` `Google: Detected` `Ikarus: Trojan.MSIL.AsyncRAT` `Jiangmin: Backdoor.MSIL.gguk` `K7AntiVirus: Trojan ( 005c228f1 )` `K7GW: Trojan ( 005c228f1 )` `Kaspersky: HEUR:Backdoor.MSIL.Crysan.gen` `Kingsoft: MSIL.Backdoor.Crysan.gen` `Lionic: Trojan.Win32.AsyncRAT.m!c` `Malwarebytes: Generic.Trojan.MSIL.DDS` `MaxSecure: Trojan.Malware.300983.susgen` `McAfeeD: Trojan:Win/Generic.BCX` `MicroWorld-eScan: Generic.AsyncRAT.Marte.B.CAADFDDD` `Microsoft: Backdoor:MSIL/AsyncRat!atmn` `NANO-Antivirus: Trojan.Win32.AsyncRAT.lhhviy` `Paloalto: generic.ml` `Rising: Trojan.AntiVM!1.CF63 (CLASSIC)` `SUPERAntiSpyware: Trojan.Agent/Gen-Kryptik` `Sangfor: Suspicious.Win32.Save.a` `SentinelOne: Static AI - Malicious PE` `Skyhigh: Fareit-FZT!CBAE25CB1BFC` `Sophos: Troj/AsyncRat-B` `Symantec: Backdoor.ASync!g2` `Tencent: Trojan.Msil.Agent.zap` `TrellixENS: Fareit-FZT!CBAE25CB1BFC` `TrendMicro: Backdoor.MSIL.ASYNCRAT.SMXSR` `TrendMicro-HouseCall: Backdoor.MSIL.ASYNCRAT.SMXSR` `VBA32: OScope.Backdoor.MSIL.Crysan` `VIPRE: Generic.AsyncRAT.Marte.B.CAADFDDD` `Varist: W32/Samas.B.gen!Eldorado` `VirIT: Trojan.Win32.MSIL_Heur.A` `ZoneAlarm: Troj/AsyncRat-B` `alibabacloud: Rat:Win/AsyncRAT.Stub` `huorong: Backdoor/MSIL.DcRat.a`

Hashes

MD5	`cbae25cb1bfce14a5c0216b89526abf8` 🔍
SHA1	`f6c298ff58f3ac7e0630e485364222ed3693bef4` 🔍
SHA256	`633ebe097ad8f14f338bd3ce73938ba3c8a4ecf97fc55625427e83e50d9241ed` 🔍
SHA3	`244bb38c947eb3eeb4187ddcaf46207c3f20ee809d73d48ae7033e8001c682e8` 🔍
SSDeep	`768:RuPrZT9xSjiWUU22jmo2qrMKjPGaG6PIyzjbFgX3iO3YVvP7ZhzDBDZTx:RuPrZT9kD2VKTkDy3bCXSDP7rzFdTx` 🔍
Imports Hash	`f34d5f2d4577ed6d9ceec516c1f5a744` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`3`
TimeDateStamp	2023-Oct-16 21:40:53
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`8.0`
SizeOfCode	`0xa800`
SizeOfInitializedData	`0xa00`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0000C78E (Section: .text)`
BaseOfCode	`0x2000`
BaseOfData	`0xe000`
ImageBase	`0x400000`
SectionAlignment	`0x2000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`4.0`
Win32VersionValue	`0`
SizeOfImage	`0x12000`
SizeOfHeaders	`0x200`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_NO_SEH` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`794c85f8fcff98b892a4c99eb8bb2cc1 🔍`
SHA1	`c541f2ec05574f5235764204d5a614a546cf9603 🔍`
SHA256	`f49f10d1e74c9c14c89faa261e1d9d33ce4d41556122f658942e46a0f8fe4662 🔍`
SHA3	`8063ef322f84c1bbc05b18579be40693b6370d0141ccc7e4750bd6819bb19c94 🔍`
VirtualSize	`0xa794`
VirtualAddress	`0x2000`
SizeOfRawData	`0xa800`
PointerToRawData	`0x200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`5.51168`

.rsrc

MD5	`0f68ce4dd77ed0bb9c1e6b31f6995d94 🔍`
SHA1	`5bddb671395f48d7f6b17305f482acf16bf4d4e4 🔍`
SHA256	`0730a6f762b3ce2b86ce4a32a4415ceebe8b5f4b94fcf93a53300e92795ac365 🔍`
SHA3	`62c509528d5c7d253491564b2a21079f8666a1891ae1027f9f8bb49285dbf48e 🔍`
VirtualSize	`0x7ff`
VirtualAddress	`0xe000`
SizeOfRawData	`0x800`
PointerToRawData	`0xaa00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.88507`

.reloc

MD5	`12af31c2a96e451cd99f4699e8e6dc5a 🔍`
SHA1	`0d9d9a38424452f0df0330ba0ebe5574c7000827 🔍`
SHA256	`2ee780c276be3f8e7a8c08a709c47c1d5f711399d9cbf574f929ded5c267bf4e 🔍`
SHA3	`f5429c40436d6cd1d6c9c94bf2c036fa85f3c89533da7e6f8648c0aa272a8b6f 🔍`
VirtualSize	`0xc`
VirtualAddress	`0x10000`
SizeOfRawData	`0x200`
PointerToRawData	`0xb200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.0815394`

Imports

mscoree.dll	`_CorExeMain`

Delayed Imports

1

Type	`RT_VERSION`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x2cc`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.15228`
MD5	`16ec11406456535d1de48d96513667e8 🔍`
SHA1	`a60ebbbcae868abd27fc96e22701fae48940e53c 🔍`
SHA256	`23202710be8c5fc9672495b0b62bebcf29a087cc7e07236f6bb155efb6e499ad 🔍`
SHA3	`ec347df0db7e63c15cad3d1f9d2b5b4d497473b5992bd681fc145eb5057ecb7d 🔍`

1 (#2)

Type	`RT_MANIFEST`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x493`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.22615`
MD5	`f3d7095de1636559aa56ad81b25bbff9 🔍`
SHA1	`6a55e1445c1c915664fba385828c5a0078fe460d 🔍`
SHA256	`4ff1c75a93b2280dabe75acecade82d644388c9f4412565d846aeb396bfdc133 🔍`
SHA3	`66d420e8633fd20ebea3048e5ed6afe3cf66dcb6d5041729ab7c7faa44b0a1b0 🔍`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	1.0.0.0
ProductVersion	1.0.0.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	UNKNOWN
Comments
CompanyName
FileDescription
FileVersion (#2)	1.0.0.0
InternalName	Stub.exe
LegalCopyright
LegalTrademarks
OriginalFilename	Stub.exe
ProductName
ProductVersion (#2)	1.0.0.0
Assembly Version	1.0.0.0

Resource LangID	UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.