Manalyze report for 7a9ad1df6e36181361da42b2d86c7a7010e9ff6761e08dbe16b35190ae0a66bd

This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2026-Aug-02 02:02:22
Comments	ÐÐ Ð Ð´Ð»Ñ Ð½Ð¾ÑÐ°ÑÐ¸ÑÑÐ¾Ð²
CompanyName	ÐÐÐ Â«ÐÐ¾ÑÐÐ¾Ð¼Â»
FileDescription	ÐÐ Ð Ð¢Ð°Ð±ÐµÐ»Ð»Ð¸Ð¾Ð½
FileVersion	`2.25.0.18664`
InternalName	Tabellion.exe
LegalCopyright	Â© 2026 ÐÐÐ "ÐÐ¾ÑÐÐ¾Ð¼"
LegalTrademarks
OriginalFilename	Tabellion.exe
ProductName	ÐÐ Ð Ð¢Ð°Ð±ÐµÐ»Ð»Ð¸Ð¾Ð½
ProductVersion	`2.25.0.18664`
Assembly Version	2.25.0.18664

Plugin Output

Info	Matching compiler(s):	`.NET executable -> Microsoft`
Info	Interesting strings found in the binary:	`Contains domain names: firebirdsql.org http://www.w3.org http://www.w3.org/2000/svg https://aka.ms https://www.firebirdsql.org https://www.firebirdsql.org/en/firebird-2-5-8/ inkscape.org www.firebirdsql.org www.inkscape.org www.w3.org`
Info	The PE is digitally signed.	`Signer: OOO Notkom` `Issuer: GlobalSign GCC R45 EV CodeSigning CA 2020`
Suspicious	No VirusTotal score.	`This file has never been scanned on VirusTotal.`

Hashes

MD5	`aa1497fe36df494bf35f03e457c292de`
SHA1	`11123ebeca30fef4f809d4588efa46f12dab2ed8`
SHA256	`7a9ad1df6e36181361da42b2d86c7a7010e9ff6761e08dbe16b35190ae0a66bd`
SHA3	`50c8310381943bb4d126edab20194633c24f08d1f46b1e16f1d94ef0ee37e9b2`
SSDeep	`6144:TvFOlXeZr1ksfi2hLw0KaWgnUf5kUf5Mb07E:DkGVpw0RWgu/W04`
Imports Hash	`f34d5f2d4577ed6d9ceec516c1f5a744`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`3`
TimeDateStamp	2026-Aug-02 02:02:22
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`48.0`
SizeOfCode	`0xc1a00`
SizeOfInitializedData	`0x43000`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x000C393A (Section: .text)`
BaseOfCode	`0x2000`
BaseOfData	`0xc4000`
ImageBase	`0x400000`
SectionAlignment	`0x2000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x10a000`
SizeOfHeaders	`0x200`
Checksum	`0x117086`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NO_SEH` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`89610b665791612f417eb866e9d1d648`
SHA1	`7c594bb9c396acb50b5fcb2c1880b9e908d8d9e8`
SHA256	`65088c4a3cb28259e23865d07d7ed87277ebfd878bc9e91ce9cf69e2b8c9b396`
SHA3	`24326159ab4625f96fb074c827c471375f212fcae63e0243a0b19090699e5202`
VirtualSize	`0xc1950`
VirtualAddress	`0x2000`
SizeOfRawData	`0xc1a00`
PointerToRawData	`0x200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`5.53308`

.rsrc

MD5	`20be3768418b22ce061765d67f4b4c19`
SHA1	`7c52754272b8a10d90eb0b0cefa63b56f3ff9f65`
SHA256	`6e473a0c2ad05a9d98bd941b51a33dab15906190dd7d7a245d012a9ddbba4106`
SHA3	`96ca1a0af718cd0796e301bc516cf3f7df8f1dddc7c716653016a998ff8b136c`
VirtualSize	`0x42d4c`
VirtualAddress	`0xc4000`
SizeOfRawData	`0x42e00`
PointerToRawData	`0xc1c00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.5249`

.reloc

MD5	`859eb35e39871b3e56e6a8fd367fd376`
SHA1	`c601e8b4da23c89b2cf8621065358c0555dbfb90`
SHA256	`dc22bbd297382537bdf98f7ec6db4dcff7885c7164409250267b03fcfd6b37d0`
SHA3	`41ecfc3b7be551d8827e648574d09b7fe27d7f9deecc43b5e6ce2b10c5777feb`
VirtualSize	`0xc`
VirtualAddress	`0x108000`
SizeOfRawData	`0x200`
PointerToRawData	`0x104a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.0980042`

Imports

mscoree.dll	`_CorExeMain`

Delayed Imports

1

Type	`RT_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x41c28`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.48302`
MD5	`ec9c0533aa0c90443e3d7f7f2c293d31`
SHA1	`4c28bad7df59a6299b8be41dfaded1d4a06b7f33`
SHA256	`3f8ce5aef316204cd0c1d4b08f86a20837c2638f16013db6d19a5a63149edc06`
SHA3	`f50f6a375e66352f4348b682a735a06f2a251c2cf7b51d368cdf5c9968e08754`

32512

Type	`RT_GROUP_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x14`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.01924`
Detected Filetype	Icon file
MD5	`a9c8e351d04401e514b9ad9d9eb0aff2`
SHA1	`b3d7b9305acc2f0c6ab6180bcf26d8b1dd52fe88`
SHA256	`f10f07e41ec1cc6e177b0e4be401e52c7c2a14d7ebd3a58178b06ea01b3c54a6`
SHA3	`d3db83f707ead6cfc1d366c769a9c66472e8a3513c951239aa7156186bc0b752`

1 (#2)

Type	`RT_VERSION`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x38e`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.81597`
MD5	`4c351c8f3dfd5a4194ed3dc27dbcb2ba`
SHA1	`a81cad57760e9ed11965de117c45f25aeb7c89f0`
SHA256	`c80b8a8b4dc9ac07a9b15c27b835dca448def5f2754f30a00c0c75eab6386eb3`
SHA3	`300fb1be7ab775678652cca04cd21fdf7c9c19ffc034e85c5bb380f9b5b114ac`

1 (#3)

Type	`RT_MANIFEST`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0xc49`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.0032`
MD5	`4c452905677149b20b57be36c1ddd96c`
SHA1	`eb33a12e31c4b75ce960e8bf7e14e47a1b0af53e`
SHA256	`dd22044559f5f51e395eb56b08ac008b4876a74361288ac87c0bab180102826b`
SHA3	`4ab55d9a97c65fa3535a763389ccaa10e34b80322479614c7fd5e838c77e4926`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	2.25.0.18664
ProductVersion	2.25.0.18664
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	UNKNOWN
Comments	ÐÐ Ð Ð´Ð»Ñ Ð½Ð¾ÑÐ°ÑÐ¸ÑÑÐ¾Ð²
CompanyName	ÐÐÐ Â«ÐÐ¾ÑÐÐ¾Ð¼Â»
FileDescription	ÐÐ Ð Ð¢Ð°Ð±ÐµÐ»Ð»Ð¸Ð¾Ð½
FileVersion (#2)	2.25.0.18664
InternalName	Tabellion.exe
LegalCopyright	Â© 2026 ÐÐÐ "ÐÐ¾ÑÐÐ¾Ð¼"
LegalTrademarks
OriginalFilename	Tabellion.exe
ProductName	ÐÐ Ð Ð¢Ð°Ð±ÐµÐ»Ð»Ð¸Ð¾Ð½
ProductVersion (#2)	2.25.0.18664
Assembly Version	2.25.0.18664

Resource LangID	UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.