69c1c648ca3a5537c1afed2364f55d8c
This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2021-Jan-18 01:44:27 |
| Comments | |
| CompanyName | |
| FileDescription | OQ.MineBot |
| FileVersion | 1.0.0.0 |
| InternalName | OQ.MineBot.GUI.exe |
| LegalCopyright | Copyright © 2017 |
| LegalTrademarks | |
| OriginalFilename | OQ.MineBot.GUI.exe |
| ProductName | OQ.MineBot.GUI |
| ProductVersion | 1.0.0.0 |
| Assembly Version | 1.0.0.0 |
Plugin Output
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Looks for Qemu presence:
|
| Suspicious |
Unusual section name found: A3\x059m"(`
Section A3\x059m"(` is both writable and executable. Unusual section name found: |
|
| Malicious | VirusTotal score: 7/67 (Scanned on 2021-06-02 18:58:50) |
McAfee-GW-Edition:
BehavesLike.Win32.Generic.wc
Gridinsoft: Trojan.Heur!.03013281 AhnLab-V3: Unwanted/Win32.Agent.R233985 Malwarebytes: Trojan.Crypt.MSIL SentinelOne: Static AI - Suspicious PE Webroot: W32.Coinminer.Gen CrowdStrike: win/malicious_confidence_60% (W) |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 5 |
| TimeDateStamp | 2021-Jan-18 01:44:27 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 48.0 |
| SizeOfCode | 0x1d5c00 |
| SizeOfInitializedData | 0x1d9e00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x003B600A (Section: ) |
| BaseOfCode | 0x1ac000 |
| BaseOfData | 0x2000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x3b8000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
A3\x059m"(`
.text
.rsrc
.reloc
Section_5
Imports
| mscoree.dll |
_CorExeMain
|
|---|
Delayed Imports
1
2
3
4
5
6
32512
1 (#2)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.0.0.0 |
| ProductVersion | 1.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| Comments | |
| CompanyName | |
| FileDescription | OQ.MineBot |
| FileVersion (#2) | 1.0.0.0 |
| InternalName | OQ.MineBot.GUI.exe |
| LegalCopyright | Copyright © 2017 |
| LegalTrademarks | |
| OriginalFilename | OQ.MineBot.GUI.exe |
| ProductName | OQ.MineBot.GUI |
| ProductVersion (#2) | 1.0.0.0 |
| Assembly Version | 1.0.0.0 |
| Resource LangID | UNKNOWN |
|---|