Manalyze report for 8611795bbd158364f838b32f61566667

This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2017-Nov-13 14:58:16
Debug artifacts	C:\AM_Source\AMC\AMC\obj\x86\Release\AMC.pdb
FileDescription	AMC
FileVersion	`1.0.0.0`
InternalName	AMC.exe
LegalCopyright	Copyright © 2017
OriginalFilename	AMC.exe
ProductName	AMC
ProductVersion	`1.0.0.0`
Assembly Version	1.0.0.0

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C# v7.0 / Basic .NET` `.NET executable -> Microsoft`
Malicious	VirusTotal score: 6/67 (Scanned on 2018-07-16 12:58:33)	`McAfee: Artemis!8611795BBD15` `Paloalto: generic.ml` `McAfee-GW-Edition: Artemis` `MAX: malware (ai score=95)` `AegisLab: Gen.Variant.Ursu!c` `Qihoo-360: Win32/Trojan.914`

Hashes

MD5	`8611795bbd158364f838b32f61566667`
SHA1	`4c852301e9c8f9c6cddee25333cd1df349134af2`
SHA256	`339b5e6f87389248fb6bbeb2c64a40ccbb7d8c40cbe50e40efbabbebb4ccfb7c`
SHA3	`6091b6ca614552bc0f4dbedcaf8d03412697db65c289d817db97f1f744c11120`
SSDeep	`96:5rXuGMf2gCw0WaYfg0uKFIwUp1dSaRPaLBe6gx1bAy8XvfyXwdrtzNt:defBCoThIwUpD9PCBhgjk/ZH`
Imports Hash	`f34d5f2d4577ed6d9ceec516c1f5a744`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`3`
TimeDateStamp	2017-Nov-13 14:58:16
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`11.0`
SizeOfCode	`0x1800`
SizeOfInitializedData	`0x800`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x000036FE (Section: .text)`
BaseOfCode	`0x2000`
BaseOfData	`0x4000`
ImageBase	`0x400000`
SectionAlignment	`0x2000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`4.0`
Win32VersionValue	`0`
SizeOfImage	`0x8000`
SizeOfHeaders	`0x200`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_NO_SEH` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`9ee32de202296beec392d67f2fb00e20`
SHA1	`777939b412318d48b49a310c9b0b64be794cc053`
SHA256	`3467f9ada71d463c9cd4c2e023beadc0785090019b30eea5b75d7d148db6fe32`
SHA3	`80e4daf3163a92ff1dcc7eaf83b93b30adb8aabd027cb586eb92d883c0474ce8`
VirtualSize	`0x1704`
VirtualAddress	`0x2000`
SizeOfRawData	`0x1800`
PointerToRawData	`0x200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`5.39021`

.rsrc

MD5	`85217e0515591a234ed00d9bbebbe834`
SHA1	`f5f427cd9d0aa15e8e068afcbeb966aff247684f`
SHA256	`f7d44fd9ef7d779d992ac9da881020d1a37753fe58ef189f416f0cc9d4711884`
SHA3	`a0417cc08a107be7969bc4552624533e1a967a1530e1787bd018fbee16b18e20`
VirtualSize	`0x510`
VirtualAddress	`0x4000`
SizeOfRawData	`0x600`
PointerToRawData	`0x1a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`3.83383`

.reloc

MD5	`9ee4069ddd79212eb3e3383b9ce0d42a`
SHA1	`bb5506fe5a5ddaba6462a0b4308dd350898950ed`
SHA256	`85d9ce93cdf45fbd3b89107451e866370b1c6cd5439e94714d975ae405c0533f`
SHA3	`7bd0640444392b639191f8779d6aec6eaa6663a4962bc15f376998cdbd9d4988`
VirtualSize	`0xc`
VirtualAddress	`0x6000`
SizeOfRawData	`0x200`
PointerToRawData	`0x2000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.0611629`

Imports

mscoree.dll	`_CorExeMain`

Delayed Imports

1

Type	`RT_VERSION`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x280`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.26502`
MD5	`7c81b361874316b65b30132121b64a98`
SHA1	`ef281c7add71b61db5bc1005e4c9fc5c99d92a94`
SHA256	`226548a307d3370f0365b3471a5b0bbaea62468d94cb18a1e97e4757b0a31352`
SHA3	`d685b1255e744eb86e199f7c1437237c1146b9cc7069dfde685eb487adfa3ec0`

1 (#2)

Type	`RT_MANIFEST`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x1ea`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.00112`
MD5	`a19a2658ba69030c6ac9d11fd7d7e3c1`
SHA1	`879dcf690e5bf1941b27cf13c8bcf72f8356c650`
SHA256	`c0085eb467d2fc9c9f395047e057183b3cd1503a4087d0db565161c13527a76f`
SHA3	`93cbaf236d2d3870c1052716416ddf1c34f21532e56dd70144e9a01efcd0ce34`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	1.0.0.0
ProductVersion	1.0.0.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	UNKNOWN
FileDescription	AMC
FileVersion (#2)	1.0.0.0
InternalName	AMC.exe
LegalCopyright	Copyright © 2017
OriginalFilename	AMC.exe
ProductName	AMC
ProductVersion (#2)	1.0.0.0
Assembly Version	1.0.0.0

Resource LangID	UNKNOWN

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics	`0`
TimeDateStamp	2017-Nov-13 14:58:16
Version	`0.0`
SizeofData	`69`
AddressOfRawData	`0x3660`
PointerToRawData	`0x1860`
Referenced File	C:\AM_Source\AMC\AMC\obj\x86\Release\AMC.pdb

TLS Callbacks

Load Configuration

RICH Header

8611795bbd158364f838b32f61566667

Summary

Plugin Output

Hashes

DOS Header

PE Header

Image Optional Header

.text

.rsrc

.reloc

Imports

Delayed Imports

1

1 (#2)

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

TLS Callbacks

Load Configuration

RICH Header

Errors