888005e38e5b5b112018cf6e4dfe63c2
This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2020-Sep-16 12:30:21 |
Plugin Output
| Info | Matching compiler(s): | Microsoft Visual C# v7.0 / Basic .NET |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Info | Cryptographic algorithms detected in the binary: | Uses constants related to MD5 |
| Suspicious | The file contains overlay data. |
36680 bytes of data starting at offset 0x41000.
The overlay data has an entropy of 7.99462 and is possibly compressed or encrypted. |
| Malicious | VirusTotal score: 23/66 (Scanned on 2020-09-16 09:28:31) |
Elastic:
malicious (high confidence)
McAfee: Artemis!888005E38E5B Sangfor: Malware Cybereason: malicious.d0adfa Symantec: ML.Attribute.HighConfidence ESET-NOD32: a variant of MSIL/Packed.SmartAssembly.AZ APEX: Malicious Paloalto: generic.ml Cynet: Malicious (score: 100) Kaspersky: HEUR:Backdoor.MSIL.NetWiredRC.gen Avast: Win32:RATX-gen [Trj] DrWeb: Trojan.PackedNET.276 Invincea: Generic ML PUA (PUA) FireEye: Generic.mg.888005e38e5b5b11 SentinelOne: DFI - Malicious PE ZoneAlarm: HEUR:Backdoor.MSIL.NetWiredRC.gen BitDefenderTheta: Gen:NN.ZemsilF.34242.smZ@aSeIfub Ikarus: Trojan.MSIL.SmartAssembly eGambit: Unsafe.AI_Score_95% Fortinet: MSIL/Kryptik.SHS!tr AVG: Win32:RATX-gen [Trj] CrowdStrike: win/malicious_confidence_100% (W) Qihoo-360: HEUR/QVM03.0.F69B.Malware.Gen |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2020-Sep-16 12:30:21 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 8.0 |
| SizeOfCode | 0x40800 |
| SizeOfInitializedData | 0x600 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0004273B (Section: .text) |
| BaseOfCode | 0x2000 |
| BaseOfData | 0x44000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x48000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rsrc
.reloc
Imports
| mscoree.dll |
_CorExeMain
|
|---|