80c092fa7a3558e429c0667cfe1180a1
This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2019-May-15 19:21:05 |
| Debug artifacts |
g:\hargardiusx\hargardius\obj\x86\Debug\hargardius.pdb
|
| FileDescription | hargardius |
| FileVersion | 1.0.0.0 |
| InternalName | hargardius.exe |
| LegalCopyright | Copyright © 2019 |
| OriginalFilename | hargardius.exe |
| ProductName | hargardius |
| ProductVersion | 1.0.0.0 |
| Assembly Version | 1.0.0.0 |
Plugin Output
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
May have dropper capabilities:
|
| Malicious | VirusTotal score: 11/73 (Scanned on 2019-05-20 13:40:58) |
CAT-QuickHeal:
Trojan.Infosteal.S6204156
Cylance: Unsafe TheHacker: Trojan/FraudPack.ajum Kaspersky: UDS:DangerousObject.Multi.Generic Tencent: Win32.Trojan.Raasmx.Auto Endgame: malicious (moderate confidence) F-Secure: Heuristic.HEUR/AGEN.1040801 SentinelOne: DFI - Suspicious PE Avira: HEUR/AGEN.1040801 ESET-NOD32: a variant of MSIL/Agent.BNY Cybereason: malicious.7ad843 |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2019-May-15 19:21:05 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 11.0 |
| SizeOfCode | 0x91ba00 |
| SizeOfInitializedData | 0xc00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0091D87E (Section: .text) |
| BaseOfCode | 0x2000 |
| BaseOfData | 0x91e000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x922000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rsrc
.reloc
Imports
| mscoree.dll |
_CorExeMain
|
|---|
Delayed Imports
2
32512
1
1 (#2)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.0.0.0 |
| ProductVersion | 1.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| FileDescription | hargardius |
| FileVersion (#2) | 1.0.0.0 |
| InternalName | hargardius.exe |
| LegalCopyright | Copyright © 2019 |
| OriginalFilename | hargardius.exe |
| ProductName | hargardius |
| ProductVersion (#2) | 1.0.0.0 |
| Assembly Version | 1.0.0.0 |
| Resource LangID | UNKNOWN |
|---|
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2019-May-15 19:21:05 |
| Version | 0.0 |
| SizeofData | 284 |
| AddressOfRawData | 0x91d70c |
| PointerToRawData | 0x91b90c |
| Referenced File | g:\hargardiusx\hargardius\obj\x86\Debug\hargardius.pdb |
TLS Callbacks
Load Configuration
RICH Header
Errors
[!] Error: Yara error: ERROR_TOO_MANY_MATCHES