81d1e7ed332cf75800f18848df764fe6
This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2022-Jan-13 14:19:00 |
| FileDescription | |
| FileVersion | 0.0.0.0 |
| InternalName | MaxiRaccolta2.0.exe |
| LegalCopyright | |
| OriginalFilename | MaxiRaccolta2.0.exe |
| ProductVersion | 0.0.0.0 |
| Assembly Version | 0.0.0.0 |
Plugin Output
| Info | Matching compiler(s): | Microsoft Visual C# v7.0 / Basic .NET |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Looks for Qemu presence:
|
| Malicious | VirusTotal score: 40/65 (Scanned on 2022-01-13 22:37:35) |
Lionic:
Trojan.Win32.Generic.j!c
Elastic: malicious (high confidence) Cynet: Malicious (score: 99) CAT-QuickHeal: Trojan.MsilFC.S23210427 ALYac: IL:Trojan.MSILZilla.5554 Cylance: Unsafe Sangfor: Trojan.Win32.Save.a Alibaba: Ransom:MSIL/FileCoder.9bcd4b18 CrowdStrike: win/malicious_confidence_90% (W) ESET-NOD32: a variant of MSIL/Filecoder.AGP APEX: Malicious Avast: Win32:RansomX-gen [Ransom] ClamAV: Win.Ransomware.Hydracrypt-9878672-0 Kaspersky: HEUR:Trojan-Ransom.Win32.Generic BitDefender: IL:Trojan.MSILZilla.5554 MicroWorld-eScan: IL:Trojan.MSILZilla.5554 Tencent: Win32.Trojan.Generic.Eawv Ad-Aware: IL:Trojan.MSILZilla.5554 Sophos: ML/PE-A F-Secure: Heuristic.HEUR/AGEN.1138919 DrWeb: Trojan.Encoder.34437 McAfee-GW-Edition: GenericRXQG-EP!81D1E7ED332C FireEye: Generic.mg.81d1e7ed332cf758 Emsisoft: IL:Trojan.MSILZilla.5554 (B) Ikarus: Trojan-Ransom.Penta GData: MSIL.Trojan-Ransom.Remind.B Avira: HEUR/AGEN.1138919 Arcabit: IL:Trojan.MSILZilla.D15B2 Microsoft: Ransom:MSIL/FileCoder.AD!MTB AhnLab-V3: Malware/Win.Generic.C4581699 McAfee: GenericRXQG-EP!81D1E7ED332C MAX: malware (ai score=81) Malwarebytes: Malware.AI.3384415825 Rising: Ransom.Destructor!1.B060 (CLASSIC) SentinelOne: Static AI - Malicious PE MaxSecure: Trojan.Malware.300983.susgen Fortinet: MSIL/Filecoder.AGP!tr.ransom BitDefenderTheta: AI:Packer.85A25CC51F AVG: Win32:RansomX-gen [Ransom] Cybereason: malicious.d332cf |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2022-Jan-13 14:19:00 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 11.0 |
| SizeOfCode | 0x142600 |
| SizeOfInitializedData | 0x35800 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x001443FE (Section: .text) |
| BaseOfCode | 0x2000 |
| BaseOfData | 0x146000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x17e000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rsrc
.reloc
Imports
| mscoree.dll |
_CorExeMain
|
|---|
Delayed Imports
2
32512
1
1 (#2)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 0.0.0.0 |
| ProductVersion | 0.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| FileDescription | |
| FileVersion (#2) | 0.0.0.0 |
| InternalName | MaxiRaccolta2.0.exe |
| LegalCopyright | |
| OriginalFilename | MaxiRaccolta2.0.exe |
| ProductVersion (#2) | 0.0.0.0 |
| Assembly Version | 0.0.0.0 |
| Resource LangID | UNKNOWN |
|---|